SonicWall Won't Patch GMS: Unauthenticated File Read CVE-2026-109593 (CVSS 9.1) and SQL Injection CVE-2026-109594 Stay Open in End-of-Life Software

Cyber · 2026-11-08 · By H.A

SonicWall advisory SNWLID-2026-0019 discloses a critical unauthenticated file-read flaw and a post-auth SQL injection in GMS 9.5.2 and earlier, and says no fix will ever ship because the product is past end of support.

SonicWall has disclosed two new vulnerabilities in its Global Management System (GMS) and says it will never patch them. One is a critical file-read flaw that needs no login. GMS has passed its end of support, so the vendor's only answer is to migrate to its replacement, Network Security Manager (NSM). Any organisation still running GMS now has a management server with a published, unfixable hole.

What Happened

SonicWall published advisory SNWLID-2026-0019 on 3 November 2026. It covers two flaws:

• CVE-2026-109593 (CVSS 9.1): an unauthenticated file-read vulnerability. An attacker who can reach GMS over the network could read internal GMS files and potentially expose sensitive information.
• CVE-2026-109594 (CVSS 6.8): a post-authentication SQL injection. An authenticated attacker could, under specific conditions, read or modify information in the GMS database.

Both affect GMS 9.5.2 and earlier. SonicWall says no remediation or security update will be issued because the product has reached end of life.

Technical Details

GMS is SonicWall's legacy platform for centrally managing fleets of SonicWall firewalls. It handles policy, provisioning, reporting and monitoring. That job makes it a valuable target. A management server typically stores configuration for many devices, along with administrator accounts, logs and connection details for the firewalls it controls.

An unauthenticated file read on such a system is serious even though it is "only" a read. Depending on which files are reachable, an attacker might get configuration exports, credentials or keys stored on disk, or information that helps with the next step of an attack. The SQL injection needs a valid login, which is why its score is lower. But it allows modification of the database, not just reading. If file-read access ever yields administrator credentials, the two flaws together become a much more dangerous pair.

SonicWall has not published exploitation details, and there are no public reports of either flaw being exploited so far.

Who Is Affected

• Organisations still running SonicWall GMS 9.5.2 or earlier, on-premises or as a virtual appliance.
• MSPs and enterprises that kept GMS after the end-of-life announcement because it still "worked".
• Exposure is highest where the GMS web interface is reachable from the internet or from large, flat internal networks.

According to SonicWall's product lifecycle table, the end of life for GMS 9.x was announced on 5 May 2025, and the last day of support was 30 September 2026. These flaws were disclosed barely a month after support ended.

Patch Status

There is no patch and there will not be one. SonicWall "strongly encourages" customers to move to Network Security Manager (NSM), its current management platform, and has published a GMS-to-NSM transition FAQ.

The disclosure comes at a busy time for SonicWall customers. Less than a month earlier, the vendor fixed a CVSS 10.0 pre-authentication SSRF flaw, CVE-2026-102255, which is under active exploitation. This week CISA also added the SonicOS SSLVPN SAML bypass CVE-2026-19868 to its KEV catalog. Attackers clearly pay close attention to SonicWall gear.

What To Do Now

If you still run GMS, treat it as a known-vulnerable asset and plan around that:

1. Inventory. Find every GMS instance, including forgotten lab or DR copies, and record its version.
2. Cut exposure immediately. Remove any internet access to the GMS web interface. Restrict it to a dedicated management VLAN and a short allow-list of admin workstations or a jump host.
3. Rotate secrets. Assume anything on the box could be read. Change GMS administrator passwords and any credentials GMS uses to talk to managed firewalls, and review admin accounts for ones you don't recognise.
4. Watch it closely. Forward GMS web and system logs to your SIEM. Alert on unusual file-path requests, unexpected admin logins and database errors.
5. Migrate. Schedule the move to NSM (or another supported management option) as a security project with a deadline, not as a nice-to-have.

A simple check from outside your network confirms whether the interface is exposed:

# Run from an external host; replace with your public IP or hostname
nmap -Pn -p 80,443,8080,8443 gms.example[.]com

Why It Matters

End-of-life notices are easy to postpone. The product keeps running, the migration costs money, and nothing seems to change on the day support ends. SNWLID-2026-0019 shows what actually changes. A month after support ended, a critical unauthenticated bug was published along with an explicit statement that it will stay open.

For defenders, the CVE number itself is now a risk. Its disclosure tells attackers where to look, and the advisory tells them no fix is coming. Management planes are especially attractive because compromising one server can reach every device it manages. If GMS is still in your environment, it should be at the top of the list for isolation and replacement.