Organizations still using SonicWall Global Management System (GMS) face a security decision that a normal patch cycle will not resolve. SonicWall has disclosed two vulnerabilities in GMS 9.5.2 and earlier and says it will not release fixes because the product has reached end of life.
The company’s November 3 advisory, SNWLID-2026-0019, covers the virtual appliance and Windows deployments. It recommends moving to Network Security Manager (NSM). This follows the previously announced end of support on September 30, 2026; the vulnerability disclosure is new, but the retirement decision is not.
A login is not required for the more severe flaw
CVE-2026-109593 allows an unauthenticated attacker with network access to read internal GMS files, potentially exposing sensitive information. Its CVSS 3.1 score is 9.1, rated Critical. Requiring users to sign in to the normal management interface therefore does not address this attack path.
The second issue, CVE-2026-109594, is a post-authentication SQL injection vulnerability. Under specific conditions, an authenticated attacker could access or modify information in the GMS database. It is rated Medium at 6.8; the published scoring vector specifies high privileges. The two flaws have different prerequisites and should not be described as equivalent unauthenticated attacks.
SonicWall lists no workaround and no fixed GMS release. The official CVE records also identify the product as unsupported when the vulnerabilities were assigned. Neither finding is a disclosure about the firmware running on every firewall managed through GMS.
Plan the replacement and reduce exposure during the transition
For administrators, the first useful inventory is the management system itself: its version, deployment type and the networks that can reach it. As a risk-reduction measure while replacement is arranged, limit access to the smallest necessary set of trusted administration systems. That reduces reachability; it does not repair either vulnerability or replace the vendor’s migration recommendation.
Migration planning should cover the devices and firmware under management, reporting needs and administrator access. SonicWall’s GMS–NSM comparison provides a starting point for checking capabilities. Teams should validate a supported destination and the transition process for their own environment rather than treating a replacement console as a drop-in software patch.
CISA’s enrichment in the two CVE records assessed exploitation as “none” on November 3. That dated assessment does not establish that exploitation cannot occur, and waiting for confirmed attacks would leave an unsupported management system exposed.
