SonicWall Leaves Critical Unauthenticated File-Read Flaw in End-of-Life GMS Unpatched
SonicWall disclosed two vulnerabilities in its Global Management System (GMS), version 9.5.2 and earlier, on November 3, 2026, via advisory SNWLID-2026-0019, but will not fix them because the product has already reached end-of-life. The more severe issue, CVE-2026-109593 (CVSS 9.1, critical), allows an unauthenticated attacker with network access to read internal GMS files, potentially exposing sensitive information. The second, CVE-2026-109594 (CVSS 6.8, medium), is a post-authentication SQL injection that lets a highly privileged user access or modify records in the GMS database. SonicWall has stated it has seen no evidence of active exploitation of the two GMS flaws, and no public exploit code is currently known to exist. SonicWall appliances have been a recurring target for attackers throughout 2026, having been hit by multiple SMA1000 zero-days patched in February, July, September and October, and the company's track record includes 19 vulnerabilities added by CISA to its Known Exploited Vulnerabilities catalog over the past four years, 13 of them also abused by ransomware gangs (bleepingcomputer.com).
Entenda a falha
A vulnerabilidade
SonicWall Global Management System (GMS) 9.5.2 and earlier, both Virtual Appliance and Windows builds, has two flaws disclosed in advisory SNWLID-2026-0019. CVE-2026-109593 (CVSS 9.1, critical) lets an unauthenticated attacker with network access read internal GMS files, which may expose sensitive information. CVE-2026-109594 (CVSS 6.8, per The Hacker News) is a post-authentication SQL injection: an authenticated, high-privilege user can access or modify records in the GMS database under specific conditions. GMS is end-of-life, so no fixed version will ever exist; SonicWall urges migration to Network Security Manager (NSM).
Como funciona
The articles give only a high-level picture. For CVE-2026-109593, a network request reaches GMS without a login, and the access checks fail open, so the software serves internal files that should be restricted. For CVE-2026-109594, a logged-in, privileged user sends input that ends up in a database query; under specific conditions the query is altered, letting that user read or change records and logs they should not reach. The exact endpoints and code steps are not described.
Por que é vulnerável
For CVE-2026-109593, securityonline.info says the bug occurs when access checks fail open, meaning the authorization logic allows access instead of denying it. For CVE-2026-109594, the articles describe SQL injection, meaning input is not safely handled before reaching a database query, with no further root-cause detail. They do not say why the flaws went unnoticed. Because GMS is end-of-life, SonicWall will not change the code, so the cause will not be fixed.
Como foi descoberta
BleepingComputer reports that Pentest-Tools security researchers found and reported both flaws; the story credits Matei "Mal" Badanoiu and Andrei Lungu via Pentest-Tools. SonicWall published advisory SNWLID-2026-0019 on 3 November 2026, and CERT-FR republished it on 4 November as CERTFR-2026-AVI-1456. SonicWall says it has seen no confirmed exploitation in customer environments. The articles do not say how or when the researchers found the bugs or reported them.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 19:16.
Detalhes técnicos
The unauthenticated file-disclosure flaw, CVE-2026-109593, stems from access checks that fail open, letting any network-reachable attacker retrieve internal files without credentials. The advisory states: "An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information." The SQL injection flaw, CVE-2026-109594, requires an authenticated, high-privilege account and a low-complexity attack to read or tamper with database records and steal logs. Both vulnerabilities affect the GMS Virtual Appliance and Windows builds on version 9.5.2 and earlier. The two CVEs were reported by researchers Matei "Mal" Badanoiu and Andrei Lungu, credited via Pentest-Tools (it-connect.tech, socradar.io). SonicWall has repeatedly been targeted in zero-day campaigns in 2026, patching SMA1000 flaws exploited in the wild in February (CVE-2026-15409, CVE-2026-15410), September (CVE-2026-83548, CVE-2026-83549) and October (CVE-2026-102255), and CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog over the last four years, 13 of them also abused by ransomware gangs (bleepingcomputer.com). The October flaw, CVE-2026-102255 (CVSS 10.0), is a critical pre-authenticated SSRF in the SMA1000 WorkPlace interface that could let an attacker reach internal functionality and perform unauthorized operations; it is unrelated to the two unpatched GMS flaws but continues to see growing exploitation, with telemetry from threat-intelligence firm Previdian recording 2,541 attack attempts from eight unique IP addresses located in Singapore and the U.S. since October 9, 2026, including as many as 30 exploitation attempts on November 3, 2026 alone (thehackernews.com).
Remediação
Because GMS reached end-of-support on September 30, 2026 (socradar.io), SonicWall confirmed that "no remediation or security update will be released for these vulnerabilities." The vendor recommends taking GMS instances offline, restricting or blocking exposed web management ports, and migrating to its supported Network Security Manager (NSM) platform as the only path to remediation. For the separately patched CVE-2026-102255, the rising exploitation volume underscores the need for SMA1000 operators to confirm the October hotfix has been applied and to restrict exposure of the WorkPlace interface (thehackernews.com).
Linha do tempo
-
SonicWall Confirms No Fix for EoL GMS Flaws as Separate SSRF Bug Sees Rising Exploitation
This article adds updated telemetry on a separate, already-patched SonicWall vulnerability, CVE-2026-102255 (SMA1000 SSRF), showing that exploitation attempts have grown substantially since its October disclosure: Previdian recorded 2,541 attack attempts from eight unique IP addresses in Singapore and the U.S. since October 9, 2026, including 30 attempts on November 3, 2026 alone, indicating sustained attacker interest well beyond the initial exploitation wave reported earlier.
ler a análise desta fonte ocultar
This article adds updated telemetry on a separate, already-patched SonicWall vulnerability, CVE-2026-102255 (SMA1000 SSRF), showing that exploitation attempts have grown substantially since its October disclosure: Previdian recorded 2,541 attack attempts from eight unique IP addresses in Singapore and the U.S. since October 9, 2026, including 30 attempts on November 3, 2026 alone, indicating sustained attacker interest well beyond the initial exploitation wave reported earlier.
SonicWall has confirmed that two vulnerabilities affecting its end-of-life Global Management System (GMS), version 9.5.2 and earlier, will not be patched because the product has already reached end-of-life. The more severe flaw, CVE-2026-109593 (CVSS score: 9.1) - An unauthenticated file read vulnerability that could allow an attacker with network access to read internal GMS files, potentially exposing sensitive information. The second, CVE-2026-109594 (CVSS score: 6.8) - A post-authentication SQL injection vulnerability that could allow an authenticated attacker to access or modify information stored in the GMS database under specific conditions. "The affected product has reached End-of-life (EoL)," SonicWall said, adding "As a result, no remediation or security update will be released for these vulnerabilities. Organizations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM)."
The article notes this disclosure comes less than a month after SonicWall shipped fixes for a separate, unrelated critical flaw, CVE-2026-102255 (CVSS score: 10.0), a critical pre-authenticated server-side request forgery (SSRF) flaw that could have allowed an attacker to reach internal functionality and perform unauthorized operations. That vulnerability has since come under active exploitation, with telemetry data from Previdian recording 2,541 attack attempts from eight unique IP addresses from Singapore and the U.S. since October 9, 2026, and as many as 30 exploitation attempts were registered on November 3, 2026.
Remediation
Because the GMS product has reached end-of-life, SonicWall will not release fixes for CVE-2026-109593 or CVE-2026-109594, and recommends migrating to the supported Network Security Manager (NSM) platform as the only path to remediation. For CVE-2026-102255, which is already patched, the sharp rise in exploitation attempts against SMA1000 appliances underscores the need to verify the October patch has been applied and that internet-exposed management interfaces are restricted.
-
SonicWall Will Not Patch Critical GMS File-Read and SQLi Flaws in End-of-Life Software
This article adds context on SonicWall's broader exploitation history, noting that the company patched multiple SMA1000 zero-days exploited in the wild throughout 2026 (February, July, September and October), and that CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog over the past four years, 13 of them also abused by ransomware gangs, reinforcing the operational risk of leaving the unauthenticated GMS file-read flaw unpatched.
ler a análise desta fonte ocultar
This article adds context on SonicWall's broader exploitation history, noting that the company patched multiple SMA1000 zero-days exploited in the wild throughout 2026 (February, July, September and October), and that CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog over the past four years, 13 of them also abused by ransomware gangs, reinforcing the operational risk of leaving the unauthenticated GMS file-read flaw unpatched.
SonicWall has warned customers of two vulnerabilities affecting its end-of-life Global Management System (GMS) software, version 9.5.2 and earlier, which will not receive security patches because the product has already reached end-of-life. The flaws were found and reported by Pentest-Tools security researchers. The more severe issue, CVE-2026-109593, allows an unauthenticated attacker with network access to read internal GMS files, exposing sensitive information. The second, CVE-2026-109594, lets a highly privileged attacker access or modify data in the GMS database through low-complexity SQL injection. SonicWall is urging all remaining GMS customers to migrate to its supported Network Security Manager (NSM) platform instead.
Technical Details
CVE-2026-109593 requires no authentication and only network access to the vulnerable GMS instance, making it the more dangerous of the two issues, while CVE-2026-109594 requires an attacker to already hold high-privilege credentials before exploiting the SQL injection weakness. Both affect systems still running GMS 9.5.2 or earlier. SonicWall has repeatedly been targeted in zero-day campaigns this year, having patched SMA1000 zero-days in February, July, September and October (CVE-2026-15409, CVE-2026-15410, CVE-2026-83548, CVE-2026-83549 and CVE-2026-102255), and CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog over the past four years, 13 of which have also been abused by ransomware operators, underscoring that SonicWall appliances remain a high-value target for attackers.
Remediation
Because GMS has reached end-of-life, SonicWall stated that "no remediation or security update will be released for these vulnerabilities" and strongly encourages organizations to upgrade to the Network Security Manager (NSM) platform as the only path to remediation.
-
SonicWall Leaves Critical Unauthenticated File-Read Flaw in End-of-Life GMS Unpatched
ler a análise desta fonte ocultar
SonicWall disclosed two vulnerabilities in its Global Management System (GMS), version 9.5.2 and earlier, on November 3, 2026, via advisory SNWLID-2026-0019, but will not fix them because the product has already reached end-of-life. The more severe issue, CVE-2026-109593 (CVSS 9.1, critical), allows an unauthenticated attacker with network access to read internal GMS files, potentially exposing sensitive information. The second, CVE-2026-109594 (CVSS 6.8, medium), is a post-authentication SQL injection that lets a highly privileged user access or modify records in the GMS database. SonicWall has stated it has seen no evidence of active exploitation, and no public exploit code is currently known to exist.
Technical Details
The unauthenticated file-disclosure flaw, CVE-2026-109593, stems from access checks that fail open, letting any network-reachable attacker retrieve internal files without credentials. The advisory states: "An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information." The SQL injection flaw, CVE-2026-109594, requires an authenticated, high-privilege account and a low-complexity attack to read or tamper with database records and steal logs. Both vulnerabilities affect the GMS Virtual Appliance and Windows builds on version 9.5.2 and earlier. The two CVEs were reported by researchers Matei "Mal" Badanoiu and Andrei Lungu, credited via Pentest-Tools (it-connect.tech, socradar.io).
Remediation
Because GMS reached end-of-support on September 30, 2026 (socradar.io), SonicWall confirmed that "no remediation or security update will be released for these vulnerabilities." The vendor recommends taking GMS instances offline, restricting or blocking exposed web management ports, and migrating to its supported Network Security Manager (NSM) platform as the only path to remediation.