SonicWall GMS Unauthenticated File Disclosure and SQL Injection Flaws Will Not Be Patched Due to End-of-Life
SonicWall disclosed two vulnerabilities in its Global Management System (GMS), version 9.5.2 and earlier, affecting both Virtual Appliance and Windows builds. The most severe, CVE-2026-109593 (CVSS 9.1), allows an unauthenticated attacker with network access to read internal GMS files and potentially expose sensitive data. The second, CVE-2026-109594, is an authenticated SQL injection flaw that lets a logged-in user manipulate database queries to view or alter records and steal private logs. Because GMS has reached end-of-life, SonicWall will not release a patch for either issue, urging customers to decommission affected systems immediately and migrate to Network Security Manager. SonicWall states there is no confirmed exploitation in customer environments and no public exploit code is currently available.
Entenda a falha
A vulnerabilidade
SonicWall Global Management System (GMS) 9.5.2 and earlier, both Virtual Appliance and Windows builds, has two flaws. CVE-2026-109593 (CVSS 9.1) lets an unauthenticated attacker with network access read internal GMS files, potentially exposing sensitive information. CVE-2026-109594 is an authenticated SQL injection: a user with login rights can manipulate database queries to view or change records in the main GMS database and steal private logs. GMS is end-of-life, so SonicWall will not release a fix for either one.
Como funciona
For CVE-2026-109593, a request reaches the GMS web management interface from the network and the software is supposed to check whether the caller is allowed to read the requested internal file. That access check fails open, so the file is returned without a login. For CVE-2026-109594, a logged-in user sends input that GMS uses to build a database query; the crafted input is interpreted as SQL, so the query reads or changes more data than intended. The articles give no further detail on the specific endpoints.
Por que é vulnerável
CVE-2026-109593 stems from access checks that fail open, so a failed or missing authorization decision results in access being granted instead of denied. CVE-2026-109594 is a classic SQL injection, meaning user-supplied input is not safely handled before it is used in database queries. The articles do not say why these went unnoticed. There is no fix: because the product is end-of-life, the code will not change.
Como foi descoberta
SonicWall disclosed both flaws in a security notice on November 3, 2026. The articles do not say who found them or how. SonicWall states there is no confirmed exploitation in customer environments.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 09:10.
Detalhes técnicos
- CVE-2026-109593 (CVSS 9.1): Unauthenticated file disclosure caused by access checks failing open, allowing remote attackers to read internal GMS files.
- CVE-2026-109594: Authenticated SQL injection enabling attackers with login access to query or modify the main GMS database.
- Affected: SonicWall GMS 9.5.2 and earlier (Virtual Appliance and Windows builds).
Remediação
SonicWall confirms no security update will be issued since GMS is end-of-life. Organizations should take affected GMS instances offline immediately, block exposed web management ports, and migrate to SonicWall Network Security Manager as the supported replacement.
Linha do tempo
-
SonicWall GMS Unauthenticated File Disclosure and SQL Injection Flaws Will Not Be Patched Due to End-of-Life
ler a análise desta fonte ocultar
SonicWall disclosed two vulnerabilities in its Global Management System (GMS), version 9.5.2 and earlier, affecting both Virtual Appliance and Windows builds. The most severe, CVE-2026-109593 (CVSS 9.1), allows an unauthenticated attacker with network access to read internal GMS files and potentially expose sensitive data. The second, CVE-2026-109594, is an authenticated SQL injection flaw that lets a logged-in user manipulate database queries to view or alter records and steal private logs. Because GMS has reached end-of-life, SonicWall will not release a patch for either issue, urging customers to decommission affected systems immediately and migrate to Network Security Manager. SonicWall states there is no confirmed exploitation in customer environments and no public exploit code is currently available.
Technical Details
- CVE-2026-109593 (CVSS 9.1): Unauthenticated file disclosure caused by access checks failing open, allowing remote attackers to read internal GMS files.
- CVE-2026-109594: Authenticated SQL injection enabling attackers with login access to query or modify the main GMS database.
- Affected: SonicWall GMS 9.5.2 and earlier (Virtual Appliance and Windows builds).
Remediation
SonicWall confirms no security update will be issued since GMS is end-of-life. Organizations should take affected GMS instances offline immediately, block exposed web management ports, and migrate to SonicWall Network Security Manager as the supported replacement.