SonicWall says two security vulnerabilities in its end-of-life Global Management System (GMS) will not receive fixes, leaving versions 9.5.2 and earlier affected.
The vendor’s security advisory SNWLID-2026-0019 lists CVE-2026-109593, an unauthenticated file-read flaw that requires network access to a vulnerable system, and CVE-2026-109594, a post-authentication SQL injection vulnerability that can let a high-privilege attacker access or modify information in the GMS database.
SonicWall assigns CVE-2026-109593 a CVSS score of 9.1 and CVE-2026-109594 a score of 6.8. The advisory identifies the affected product as GMS Virtual Appliance and Windows. The first flaw could expose internal files and potentially sensitive information, while the second requires an attacker to already have high privileges.
Because GMS has reached end of life, SonicWall says it will release no remediation or security updates for either vulnerability and lists no workaround. The company recommends that organizations move to its Network Security Manager (NSM) platform.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
