SonicWall says two flaws in end of life GMS will never be fixed, one an unauthenticated file read rated 9.1
SonicWall says two flaws in its end of life GMS console, an unauthenticated file read rated 9.1 and an authenticated SQL injection rated 6.8, will never be fixed and have no workaround. Its only path is its own NSM. Read 4 November 2026.
By Parminder Kumar Sharma · LinkedIn · · 12 min read
Two flaws, a 9.1, and a fix column that says none
SonicWall's advisory SNWLID-2026-0019, first published on 3 November 2026, lists two vulnerabilities in its Global Management System, GMS, versions 9.5.2 and earlier, on the virtual appliance and on Windows. In the column where an advisory normally gives a fixed version, it prints: "A fix version is not available as the product has reached End-of-Life (EOL)." The workaround section reads "None." The headline score is 9.1, for an unauthenticated file read.
The public records were published by SonicWall as the numbering authority at 16:25 UTC (CVE-2026-109593) and 16:28 UTC (CVE-2026-109594) on 3 November, 22 calendar days after both ids were reserved on 12 October (derived). When this site read them between 16:00 and 16:05 UTC on Wednesday 4 November 2026, just under 24 hours later (derived), CISA's enrichment on both said Exploitation: none, and neither id was in CISA's Known Exploited Vulnerabilities catalogue, release 2026.11.03.
What that does not establish: that GMS is safe, or that it is under attack. The advisory says nothing about exploitation either way. It does not say which files the read exposes, how many GMS consoles are reachable, when GMS reached end of life, what moving to its replacement costs, or anything a customer can do in the meantime. Those gaps are the story, because for a product that will never be patched, the gaps are permanent.
What GMS is, and who says so
The advisory itself does not describe the product. BleepingComputer, a secondary source, says GMS "helps IT admins deploy and manage thousands of SonicWall security appliances from a single interface", and that SonicWall has officially replaced it with Network Security Manager. This site has not found that description in a SonicWall page it could read: SonicWall's product lifecycle page answered this site's request with a bot check, which was not bypassed, so the end of life date stays not stated here.
If BleepingComputer's description is right, the shape of the risk is plain. A console built to manage many firewalls from one place is a single point that touches all of them. The advisory's own words say only that the file read may expose "sensitive information"; what a management console tends to hold is this site's inference, and it is labelled as such in the checklist below.
SonicWall's comment is short: no remediation or security update will be released, and organisations "are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM)." SonicWall sells NSM, so its advice to move to NSM is also a recommendation of its own product. That is normal for an end of life notice and does not make the advice wrong; it is simply the only option the advisory offers. Earlier SonicWall advisories this year, for its SMA1000 remote access appliances, are covered in this site's brief on the SMA1000 fixes.
The two records side by side
The advisory and the two CVE.org records agree on the descriptions, the weaknesses and the scores. One detail changes how the scores should be cited: in the CVE.org records, SonicWall's own entry as numbering authority carries no CVSS score at all. The 9.1 and 6.8 in the records sit in CISA's enrichment block, which matches the scores SonicWall prints on its advisory page. NVD lists the same CISA scores as secondary and shows both records as Awaiting Analysis, so NVD has not scored them itself.
The two flaws as SonicWall's advisory, the CVE.org records and CISA's enrichment print them, read between 16:00 and 16:05 UTC on Wednesday 4 November 2026. Quotations are exact.
| Item | CVE-2026-109593 | CVE-2026-109594 |
|---|---|---|
| Bug class, as printed | Unauthenticated file read; CWE-636, Not Failing Securely ('Failing Open') | Post authentication SQL injection; CWE-89 |
| Who can trigger it | "An unauthenticated attacker with network access" | "An authenticated attacker"; the vector says high privileges |
| What it gives, per the record | "may be able to read internal GMS files, potentially exposing sensitive information" | "in specific conditions" may "access or modify information stored in the GMS database" |
| CVSS 3.1 as printed | 9.1, the advisory's headline score | 6.8 |
| Who scored it in the CVE record | CISA ADP; SonicWall's own entry carries no score | CISA ADP; SonicWall's own entry carries no score |
| CISA SSVC, 3 Nov 2026 | Exploitation none, Automatable yes, Technical Impact partial | Exploitation none, Automatable no, Technical Impact partial |
| In CISA's KEV, release 2026.11.03 | No | No |
| Fix | None: end of life | None: end of life |
Two small differences between the advisory and the records are worth knowing when you search an inventory. The advisory names the affected product as "GMS - Virtual Appliance and Windows"; the CVE records list the platforms as Windows and Linux, and do not explain the mapping. Both records also carry the CVE Program tag "unsupported-when-assigned", which says the product was already out of support when the ids were assigned.
What the printed vector says, and what the description says
The advisory's overall score of 9.1 and its vector are those of CVE-2026-109593. The vector as printed rates the file read high for confidentiality, none for integrity and high for availability. The description, as printed, speaks only of reading internal files and exposing information. It says nothing about the system going down.
This site's observation, not a correction: on CVSS 3.1 arithmetic, the availability rating is what lifts the score into the critical band. The same vector with availability set to none scores 7.5, which is high rather than critical (derived). The printed vector may reflect something the description leaves out; the advisory does not explain it, and this site does not reinterpret it. Cite 9.1, because that is what SonicWall and CISA print, and know that the critical label rests on an impact the text does not describe.
The second record has a similar gap in the other direction. Its description says an authenticated attacker could "access or modify" information in the GMS database, but the printed vector rates integrity as none. The 6.8 checks out on the printed metrics (derived). Neither observation changes the advice: an unpatchable flaw reachable without a login is the one to act on.
Stated, and not stated
What SonicWall's advisory, the CVE.org records and CISA print, and what none of them states, read between 16:00 and 16:05 UTC on Wednesday 4 November 2026. Secondary items are marked.
| Topic | Stated | Not stated |
|---|---|---|
| Fix | "A fix version is not available as the product has reached End-of-Life (EOL)." | Any future fix. SonicWall says none will be released. |
| Workaround | "None." The overview field reads false. | Any compensating control, such as restricting network access. |
| End of life date | The product "has reached End-of-Life (EOL)" | When it reached end of life, or when support ended. |
| What the file read exposes | "internal GMS files, potentially exposing sensitive information" | Which files, or what kind of information. |
| Network position | "with network access" | Which interface, port or network the attacker needs to reach. |
| Exploitation | CISA SSVC: Exploitation none, timestamped 3 Nov. Neither id in KEV 2026.11.03. | Whether anyone has tried. The advisory says nothing either way. |
| Exposure | BleepingComputer: GMS manages thousands of SonicWall appliances from one interface (secondary) | How many GMS instances exist or face the internet. |
| Replacement | Organisations are "strongly encouraged to upgrade" to NSM | Whether the move is free, what it costs, or how GMS data migrates. |
| Finder | Pentest-Tools.com researchers are credited | Any published analysis: Pentest-Tools' blog index listed none at 16:04 UTC on 4 Nov. |
The friendly name check
Several labels around this advisory sound like controls or comfort, and are neither. The most important is the first: end of life does not switch anything off. It means the vendor has stopped fixing it, while the software carries on running wherever it was installed.
Labels in the advisory, the records and the coverage, what each means on the record, and what it does not mean. This site's readings are marked.
| Label | What it means | What it does not mean |
|---|---|---|
| End of life | No remediation or security update will be released, in SonicWall's words. | That installed copies stop running. They keep working, unpatched. |
| Upgrade to NSM | SonicWall's recommended replacement, a product it sells. | An in place GMS update. The advisory gives no migration path (this site's reading). |
| Post authentication | The SQL injection needs a login; the vector says high privileges. | Harmless. A stolen admin login meets the condition (this site's reading). |
| Workaround: None | SonicWall offers no interim mitigation. | That nothing can be done. Network isolation is still open to you (this site's suggestion). |
| Exploitation: none | CISA had no evidence of exploitation on 3 November. | A forecast. The value can change on any day. |
| Steal sensitive information | BleepingComputer's verb for the file read. | The record's wording, which is "may be able to read" and "potentially exposing". |
BleepingComputer's context, checked against the catalogue
BleepingComputer's article, published at 09:42 US Eastern time on 4 November, follows the advisory closely and adds a paragraph about earlier SonicWall zero days. Every flaw in that paragraph is in SMA1000, a different product. It is context about SonicWall's year, not evidence that anyone has exploited GMS, and it should not be read as such. This site checked it against CISA's catalogue.
BleepingComputer's context paragraph of 4 November 2026 against CISA's KEV catalogue, release 2026.11.03, read 16:04 UTC on 4 November 2026. Counts are derived.
| BleepingComputer says | KEV 2026.11.03 | Result |
|---|---|---|
| 19 SonicWall entries in KEV, 13 used by ransomware | 19 entries, 13 marked Known for ransomware use; earliest added 3 Nov 2021 (derived) | Agrees. None of the 19 is a GMS flaw (derived). |
| February zero days: CVE-2026-15409 and CVE-2026-15410 | Both ids dated 14 July 2026 in KEV | The article gives the same two ids for July. Which flaws February means is not established here. |
| September: CVE-2026-83548 and CVE-2026-83549 | Both added 2 Sep 2026 | Agrees. |
| October: CVE-2026-102255 exploited as a zero day | Not in KEV 2026.11.03 | Not in the catalogue. Brief 260 recorded SonicWall reporting no exploitation on 6 Oct; the article links a later report of its own on exploitation, which this site did not read, so this is unresolved here. |
Absence from the catalogue does not prove a flaw was not exploited; it means CISA had not listed it by 20:00 UTC on 3 November. The article also says GMS flaws let attackers "steal sensitive information", a firmer verb than the record's "may be able to read". Pentest-Tools, the security company whose researchers SonicWall credits for both flaws, had published nothing on them on its blog index when this site checked at 16:04 UTC on 4 November.
What to do, in order
Items one, two and five follow the advisory and CISA's records. Items marked as this site's suggestion do not come from SonicWall. No step here describes an attack.
Take this with you
Ranked actions for anyone who runs GMS
- Find every GMS instance you run, on the virtual appliance or on Windows, and its version. SonicWall lists 9.5.2 and earlier as affected, and its advisory names no later GMS version, so treat any GMS you find as affected unless SonicWall says otherwise (this site's reading).
- Accept that there is no workaround and no fix. The advisory's only path is SonicWall Network Security Manager. Put the migration on a dated plan with an owner, and ask SonicWall or your partner in writing what the move costs and how GMS data is carried over, because the advisory does not say.
- Until GMS is gone, take it off any network an attacker can reach, the internet first, and allow its management interface only from an administration network or jump host (this site's suggestion; SonicWall prints no compensating control).
- Treat what GMS holds as sensitive. A console that manages firewalls is likely to keep their configuration and the means to log in to them; plan to rotate those credentials and review managed appliance configuration if you suspect GMS was exposed (this site's suggestion; the primaries do not list what GMS stores).
- Watch CISA's KEV catalogue and SonicWall's advisory for any change in exploitation status, and rank it again if either moves. CISA's exploitation value of none was set on 3 November and can change.
Technical details
The advisory prints no configuration, no detection rules, no indicators and no request shapes, and SonicWall publishes no fix to compare. What it and the public records do print is below, copied exactly as read between 16:00 and 16:05 UTC on Wednesday 4 November 2026. None of it is exploit detail. A defender uses the first block to match the advisory, the second to match a scanner finding to a CVE and its scoring, and the last three to know whose score they are citing and what the exploitation status was on the day.
END-OF-LIFE (EOL) SONICWALL GMS MULTIPLE VULNERABILITIES
Advisory ID SNWLID-2026-0019
First Published 2026-11-03
Last Updated 2026-11-03
Workaround false
Status Applicable
CVE CVE-2026-109593, CVE-2026-109594
CWE CWE-636, CWE-89
CVSS v3 9.1
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected Product GMS - Virtual Appliance and Windows
Affected Version(s) 9.5.2 and earlier versions
WORKAROUND None.
Fixed Versions A fix version is not available as the product has reached End-of-Life (EOL).
The two descriptions, scores, vectors and weaknesses, as the advisory prints them. The CNA descriptions in the CVE.org records are word for word the same.
CVE-2026-109593 - End-of-Life (EOL) SonicWall GMS Unauthenticated File Read Vulnerability
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.
CVSS Score: 9.1
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-636: Not Failing Securely ('Failing Open')
CVE-2026-109594 - End-of-Life (EOL) SonicWall GMS Authenticated SQL Injection Vulnerability
Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
CVSS Score: 6.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The record metadata SonicWall filed as numbering authority. Times are UTC. Note the platforms and the tag, and that this entry has no metrics field.
CVE-2026-109593
assignerShortName sonicwall
dateReserved 2026-10-12T20:55:18.449Z
datePublic 2026-11-03T16:11:00.000Z
datePublished 2026-11-03T16:25:11.831Z
product Global Management System (GMS)
platforms Windows, Linux
version 9.5.2 and earlier versions (affected)
tags unsupported-when-assigned
CVE-2026-109594
assignerShortName sonicwall
dateReserved 2026-10-12T20:55:20.613Z
datePublic 2026-11-03T16:25:00.000Z
datePublished 2026-11-03T16:28:35.183Z
product Global Management System (GMS)
platforms Windows, Linux
version 9.5.2 and earlier versions (affected)
tags unsupported-when-assigned
CISA's enrichment on each record. These are CISA's judgements, not SonicWall's, timestamped about 41 and 37 minutes after each record was published (derived).
CVE-2026-109593 (CISA ADP Vulnrichment)
cvssV3_1 vectorString CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
baseScore 9.1 baseSeverity CRITICAL
ssvc timestamp 2026-11-03T17:06:10.311409Z
Exploitation: none
Automatable: yes
Technical Impact: partial
role: CISA Coordinator
CVE-2026-109594 (CISA ADP Vulnrichment)
cvssV3_1 vectorString CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
baseScore 6.8 baseSeverity MEDIUM
ssvc timestamp 2026-11-03T17:05:39.571136Z
Exploitation: none
Automatable: no
Technical Impact: partial
role: CISA Coordinator
The NVD status, and this site's check of CISA's catalogue. The second half of the block is derived: it is the result of searching the file, not text the file prints.
NVD, CVE-2026-109593 and CVE-2026-109594
vulnStatus Awaiting Analysis
cvssMetricV31 source 134c704f-9b21-4f2e-91b3-4a467353bcc0 (CISA-ADP), type Secondary
weaknesses CWE-636 / CWE-89, source PSIRT@sonicwall.com
CISA KEV catalogue
catalogVersion 2026.11.03
dateReleased 2026-11-03T20:00:24.8741Z
count 1767
CVE-2026-109593 present: no (derived)
CVE-2026-109594 present: no (derived)
SonicWall entries: 19, none for GMS (derived)
The question the advisory leaves open
SonicWall has told GMS customers that no fix will ever come and that there is nothing to do in the meantime but move to another SonicWall product. The advisory cannot tell you the one thing that decides your risk. Where is your GMS console today, who can reach it, and which firewalls would an attacker learn about if they read its files before your migration is finished?
Key facts
Sources
- PrimarySecurity advisory SNWLID-2026-0019, End-of-Life SonicWall GMS multiple vulnerabilities, first published 3 November 2026: summary, affected product, workaround, fixed software and comments. Rendered page read and saved in a browser at 16:00 UTC on 4 November 2026; the primary for every advisory quotationSonicWall PSIRTaccessed 2026-11-04
- PrimaryCVE-2026-109593 record: published 3 November 2026 by SonicWall as the CNA, dates, platforms, tag, and CISA ADP score and SSVC entryCVE Program (CVE.org record API)accessed 2026-11-04
- PrimaryCVE-2026-109594 record: published 3 November 2026 by SonicWall as the CNA, dates, platforms, tag, and CISA ADP score and SSVC entryCVE Program (CVE.org record API)accessed 2026-11-04
- PrimaryNVD record for CVE-2026-109593, read 16:04 UTC on 4 November 2026: Awaiting Analysis, CISA-ADP score listed as secondaryNIST (National Vulnerability Database)accessed 2026-11-04
- PrimaryNVD record for CVE-2026-109594, read 16:04 UTC on 4 November 2026: Awaiting Analysis, CISA-ADP score listed as secondaryNIST (National Vulnerability Database)accessed 2026-11-04
- PrimaryKnown Exploited Vulnerabilities catalogue, release 2026.11.03 of 3 November 2026: neither GMS id present; 19 SonicWall entries, none for GMSCISAaccessed 2026-11-04
- PrimaryBlog index of the company credited as finder, read 16:04 UTC on 4 November 2026: no post on these GMS flaws listedPentest-Tools.comaccessed 2026-11-04
- Reported bySonicWall warns of unpatched flaws in end-of-life GMS software, 4 November 2026: the description of GMS and the context paragraph checked against KEVBleepingComputeraccessed 2026-11-04
