SonicWall won't patch two GMS flaws, CVE-2026-109593 and -109594, on EoL versions

SonicWall has disclosed two vulnerabilities in its Global Management System (GMS) that it will not fix, because the affected versions are end-of-life. The flaws are documented in advisory SNWLID-2026-0019 and affect GMS 9.5.2 and earlier on Windows and Linux. Both CVE records carry the unsupported-when-assigned tag.

• CVE-2026-109593 (CVSS 9.1) — an unauthenticated file-read flaw. An attacker with network access can read internal GMS files and expose sensitive information. Credited to Matei 'Mal' Bădănoiu of Pentest-Tools.com.
• CVE-2026-109594 (CVSS 6.8) — a post-authentication SQL injection. The CVE record describes it as a flaw that "in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database" (CWE-89).

What SonicWall says

Per The Hacker News, SonicWall states that "no remediation or security update will be released for these vulnerabilities." Customers are "strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM)," the supported successor. There is no mitigation on offer for GMS itself.

Exploitation status

Neither CVE has been reported exploited in the wild. The CVE record for CVE-2026-109593 lists SSVC exploitation status as "none" at assignment. The practical risk is driven by exposure, not an active campaign: CVE-2026-109593 needs only network reach to the management server and no credentials.

Action checklist

1. Confirm whether you still run GMS 9.5.2 or earlier. If so, you own an unmanaged security product with a 9.1-scored unauthenticated read.
2. Plan migration to NSM — the vendor's only remedy.
3. In the interim, take the GMS management interface off any network an untrusted party can reach. Restrict access to a dedicated management segment or VPN, and front it with an allowlist.
4. Review GMS server logs for anomalous file-read patterns while the box remains reachable.
5. Rotate credentials and secrets stored on or managed through the GMS instance; an unauthenticated read against a management plane is a credential-exposure risk.

Context

End-of-life kit that still sits in the trust path is a recurring failure mode: the vendor's clock runs out, the product stays racked, and a 9.1 arrives with no patch behind it. The unsupported-when-assigned tag is doing the work the patch normally would — it tells you the only fix is removal. If GMS still manages your firewalls, it is now part of your attack surface with nothing maintaining it, and the migration you have been deferring is the control.