SonicWall GMS Vulnerabilities Expose End-of-Life Management Systems

Executive Summary

Two security vulnerabilities have been identified in end-of-life SonicWall Global Management System (GMS) software. CVE-2026-109593 (CVSS 9.1) could allow unauthenticated attackers to read sensitive internal files, while CVE-2026-109594 (CVSS 6.8) could enable authenticated SQL injection attacks. Both vulnerabilities affect GMS version 9.5.2 and earlier. As the affected product is no longer supported, organisations are advised to migrate to SonicWall Network Security Manager and restrict access to existing GMS deployments.

Key Details

Affected Platform

SonicWall GMS Virtual Appliance and Windows deployments, version 9.5.2 and earlier.

Attack Surface

Network-accessible management services and authenticated database functionality.

Recommended Action

Identify affected deployments, restrict administrative access and migrate to a supported management platform.

Affected Environment

The vulnerabilities affect SonicWall Global Management System (GMS) version 9.5.2 and earlier, including Virtual Appliance and Windows deployments.

The product has reached end-of-life status, meaning the report does not identify an available security patch for the affected GMS versions.

Organisations continuing to operate legacy GMS installations may face increased exposure where management interfaces are accessible from untrusted networks or administrative access is insufficiently restricted.

Operational Impact

Successful exploitation could expose sensitive internal files, stored credentials and management-system information.

The unauthenticated file-read vulnerability may enable attackers with network access to retrieve sensitive GMS files. The authenticated SQL injection vulnerability could allow attackers with valid access to read or modify database information under specific conditions.

Compromise of a centralised network management platform may create additional risks to network visibility, configuration integrity and administrative security.

Technical Root Cause

CVE-2026-109593 (CVSS 9.1) is an unauthenticated file-read vulnerability affecting SonicWall GMS 9.5.2 and earlier. An attacker with network access may be able to retrieve internal application files and potentially expose sensitive information.

CVE-2026-109594 (CVSS 6.8) is an authenticated SQL injection vulnerability caused by improper neutralisation of special elements within SQL commands. Under specific conditions, an authenticated attacker may access or modify information stored in the GMS database.

Both issues affect an end-of-life product for which the report states that security updates will not be released.

Recommended Mitigation

Identify all SonicWall GMS deployments running version 9.5.2 or earlier.
Prioritise migration to SonicWall Network Security Manager or another supported solution.
Restrict GMS management interfaces to trusted administrative networks.
Apply network segmentation, firewall access controls and IP allowlisting.
Remove unnecessary administrative accounts and enforce least privilege.
Monitor logs for suspicious file access, database queries and configuration changes.
Rotate potentially exposed credentials and API keys where compromise is suspected.
Conduct regular vulnerability assessments and track the replacement of unsupported systems.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Identify and Eliminate Risks in Legacy Infrastructure

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

SonicWall PSIRT — Security advisory SNWLID-2026-0019