SonicWall Won’t Patch File-Read and SQL Injection Flaws in End-of-Life GMS
Active Exploitation · 5 sources · Updated 1h ago · First seen Nov 4, 2026
SonicWall warned that two vulnerabilities affect its end-of-life Global Management System (GMS) version 9.5.2 and earlier and will not receive security patches. CVE-2026-109593, rated 9.1, allows unauthenticated attackers with network access to read internal files and obtain sensitive information. CVE-2026-109594, rated 6.8, allows highly privileged, authenticated attackers to access or modify GMS database information through low-complexity SQL injection attacks.
SonicWall strongly urged affected organizations to migrate to Network Security Manager (NSM) rather than wait for fixes. The reports did not identify exploitation of either GMS vulnerability. Separately, The Hacker News reported active exploitation of the previously patched CVE-2026-102255, a critical pre-authentication server-side request forgery vulnerability, with Previdian recording 2,541 attack attempts since October 9, 2026; that activity should not be conflated with exploitation of the newly disclosed GMS flaws.
