Loading vulnerability…
Unauthenticated Internal File Read in SonicWall GMS
CVE-2026-109593 affects SonicWall Global Management System (GMS) 9.5.2 and earlier. An unauthenticated attacker with network access to the affected system may be able to read internal GMS files, potentially exposing sensitive information. The vulnerability is classified as failing open (CWE-636). The affected function and underlying exploitation mechanism are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may disclose sensitive information contained in internal GMS files. The assigned CVSS v3.1 vector rates confidentiality and availability impacts as high and integrity impact as none; however, the mechanism for availability impact is not specified.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. As an interim precaution, restrict network access to GMS to trusted administrative systems.
Patch, then assume compromise.
No fixed version or patch is identified. Consult SonicWall for applicable remediation and upgrade if a fixed release is confirmed. The vulnerability is tagged as affecting software that was unsupported when the vulnerability was assigned.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.