Affected Systems
SonicWall Global Management System (GMS) versions 9.5.2 and earlier. Product is end-of-life and will not receive patches. CVE-2026-109593 (CVSS 9.1) allows unauthenticated file read; CVE-2026-109594 (CVSS 6.8) is a post-auth SQL injection.
Exploitation Status
No active exploitation reported for these vulnerabilities. However, SonicWall products are high-value targets; a separate critical flaw (CVE-2026-102255) in another SonicWall product is under active exploitation with over 2,500 attack attempts recorded since October 2026.
Business Impact
Organizations running end-of-life GMS 9.5.2 or earlier face permanent exposure to unauthenticated file read attacks that could leak credentials, configuration data, or other sensitive information. No patches will be released. Attackers with network access can exploit CVE-2026-109593 without authentication. The SQL injection flaw requires authentication but could enable database tampering. Migration to SonicWall NSM is the only remediation path.
Urgency
🟠Within 24 hours
Recommended Actions
- Identify all SonicWall GMS 9.5.2 and earlier instances in your environment immediately using asset inventory or network scanning.
- Isolate affected GMS systems from untrusted networks; restrict access to management interfaces via firewall rules or VPN-only access.
- Plan and execute migration to SonicWall Network Security Manager (NSM) as the vendor-recommended replacement platform.
- Monitor network traffic to GMS instances for unusual file access patterns or SQL query anomalies; enable logging to SIEM if not already configured.
- If migration cannot occur within 30 days, consider decommissioning GMS and implementing alternative network management solutions.