Unpatched SonicWall GMS Flaws Force Migration
Two flaws in end-of-life GMS 9.5.2 and earlier will receive no fix, so administrators must move to NSM.
Updated on Nov. 4, 2026 in Cybersecurity
SonicWall has warned customers of two unpatched security flaws in its end-of-life Global Management System (GMS) software, affecting version 9.5.2 and earlier. The vulnerabilities are already disclosed and confirmed by the vendor, and SonicWall says no fix will be released, so this is an established, shipped-product risk rather than a research-stage finding.
Why it matters
Because GMS has reached end-of-life, the flaws will remain open indefinitely, forcing affected administrators to migrate rather than patch. The warning lands against a four-year pattern in which 19 SonicWall vulnerabilities were added to CISA's actively exploited list, 13 of them also abused by ransomware groups.
CVE-2026-109593 is an information-disclosure flaw that lets unauthenticated attackers with network access read internal files, while CVE-2026-109594 is a SQL injection flaw in the GMS database that requires high privileges but low attack complexity. SonicWall's end-of-life status means neither flaw will receive a patch.
The players
SonicWall
A network security vendor whose firewalls and management platforms serve more than 500,000 customers in over 215 countries through 17,000-plus partners.
Pentest-Tools
A security testing company whose researchers discovered and reported the two GMS vulnerabilities.
CISA
The U.S. Cybersecurity and Infrastructure Security Agency, which maintains the catalog of actively exploited vulnerabilities that lists 19 SonicWall flaws.
The details
SonicWall GMS is a Global Management System that IT administrators use to deploy and manage SonicWall security appliances across an organization. The two flaws work differently: CVE-2026-109593 lets an unauthenticated attacker on the network read internal files to pull out sensitive data, while CVE-2026-109594 is a SQL injection, a technique that slips database commands through input fields, which lets an attacker with high privileges read or alter records in the GMS database. Because SonicWall has replaced GMS with its Network Security Manager (NSM) platform, the company's remedy is migration rather than a patch.
Timeline
Tuesday, 3 November 2026: SonicWall urged customers to upgrade to NSM and warned of end-of-life risks.
4 November 2026: The GMS flaw warning was reported this week.
The Tech Race
The GMS warning continues a four-year run in which SonicWall products repeatedly appeared on CISA's actively exploited catalog, with 13 of 19 listed flaws also tied to ransomware operators. Its replacement, the NSM platform, is the vendor's current management product, so the end-of-life transition moves customers onto the newer stack.
Administrators running GMS 9.5.2 or earlier cannot count on a patch, so they must migrate to NSM to close these exposures. The migration is the only remediation the vendor has offered for these flaws.
The takeaway
Organizations still running GMS should plan a migration to NSM now, since these flaws will stay open. Watch whether CISA adds CVE-2026-109593 or CVE-2026-109594 to its actively exploited catalog, which would signal confirmed attacks in the wild.
Further reading
For broader context on how exploited vulnerabilities are tracked and prioritized, see the Cybersecurity section.
