Affected Systems
SonicWall Global Management System (GMS) version 9.5.2 and earlier. Product reached end-of-life; no patches will be released. CVE-2026-109593 (unauthenticated file read) and CVE-2026-109594 (authenticated SQL injection) affect all EOL versions.
Exploitation Status
No active exploitation reported. Vulnerabilities disclosed by Pentest-Tools researchers. SonicWall products frequently targeted; 19 SonicWall CVEs added to CISA KEV catalog over past four years, 13 exploited by ransomware.
Business Impact
Organizations running EOL GMS 9.5.2 or earlier face persistent risk with no vendor remediation available. CVE-2026-109593 allows unauthenticated attackers to read internal files remotely. CVE-2026-109594 enables privileged users to execute SQL injection attacks against the GMS database. Given SonicWall's history of zero-day exploitation and ransomware targeting, these unpatched flaws present elevated risk. GMS manages thousands of SonicWall security appliances, making compromise a potential pivot point for broader network access.
Urgency
🟡 Within a week
Recommended Actions
- Identify all SonicWall GMS 9.5.2 and earlier instances in your environment immediately using asset inventory and network scanning
- Migrate to SonicWall Network Security Manager (NSM) as recommended by vendor; plan migration within 30 days for internet-facing GMS systems
- If immediate migration is not feasible, isolate GMS systems from internet access and restrict network access to trusted management VLANs only
- Monitor GMS system logs and network traffic for anomalous file access attempts or SQL injection patterns (e.g., unusual database queries, authentication anomalies)
- Review GMS user accounts and enforce least privilege; disable or remove high-privilege accounts not actively required for operations