Skip to content

Back to the catalog

SonicWall warns of unpatched flaws in end-of-life GMS software
bleepingcomputer.comarticle

SonicWall warns of unpatched flaws in end-of-life GMS software

SonicWall Global Management System (GMS) 9.5.2 and earlier has two vulnerabilities that will not be patched because the product is end of life. CVE-2026-109593 lets unauthenticated network attackers read internal files. CVE-2026-109594 is a SQL injection that lets high-privilege users read or modify the GMS database. Pentest-Tools researchers reported both, and SonicWall urges migration to Network Security Manager.

TL;DR SonicWall discloses two unpatched flaws, an unauthenticated file read and a SQL injection, in end-of-life GMS 9.5.2 and earlier, and advises moving to NSM.
Open original ↗

Organisations named here

  • SonicWall
  • CISA
  • Pentest-Tools

CVEs named here

  • CVE-2026-109593
  • CVE-2026-109594
  • CVE-2026-15409
  • CVE-2026-15410
  • CVE-2026-83548
  • CVE-2026-83549
  • CVE-2026-102255

Technologies named here

  • SonicWall SMA1000
  • Network Security Manager (NSM)
  • SonicWall Global Management System
  • SonicWall Global Management System (GMS) 9.5.2 and earlier (end-of-life)
  • SonicWall Network Security Manager

Techniques named here

  • SQL injection
  • Zero-day exploitation

Concepts named here

  • CISA actively exploited vulnerabilities list
  • End-of-life software
  • Unauthenticated file read

Threat actors named here

  • Ransomware gangs (unnamed; abused 13 of the 19 SonicWall vulnerabilities CISA added to its actively exploited list over the last four years)

Also named here

  • CISA KEV

Related in AppSec