Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-6be53914c8Early warningVulnerabilityConfirmed

SonicWall says it will not patch two end-of-life GMS flaws, one rated CVSS 9.1

SonicWall warned of two vulnerabilities affecting end-of-life GMS 9.5.2 and earlier and said it will not release patches. The item describes CVE-2026-109593 (CVSS 9.1) as an unauthenticated file read flaw that lets a network-accessible attacker read internal GMS files.

Written by a model from the sources below. Verify against them.

Sources4Confirmed
Kind
Vulnerability
Vendor
SonicWall
Product
Global Management System (GMS)
Status
Confirmed
First seen
Confirmed

What to do

  • Identify any GMS 9.5.2 or earlier deployments and plan a migration to a supported version

  • Restrict network access to GMS management interfaces

  • Review GMS logs for unauthenticated file access and database changes

  • Rotate credentials and secrets stored on affected GMS systems

Timeline

  1. Made public by Mastodon
  2. First seen by cve.now1 day
  3. Record last updated
  4. Confirmed as CVE-2026-109593

Evidence 4

  1. Social
    Mastodon
    “Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially ...”
    +1 more: Mastodon
  2. Social
    Mastodon
    “The SonicWall GMS vulnerabilities patch notice details two critical SonicWall GMS vulnerabilities.”
  3. Social
    Mastodon
    “Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when processing an EPC Client update.”
  4. Press
    The Hacker News
    “SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

FAQ

Questions about SZB-6be53914c8

Has SonicWall confirmed it?

Mastodon, Mastodon and Mastodon report a possible compromise. None of the sources says it happened.Source: Mastodon, Mastodon, Mastodon, The Hacker News

What should SonicWall users do?

Identify any GMS 9.5.2 or earlier deployments and plan a migration to a supported version. Restrict network access to GMS management interfaces. Review GMS logs for unauthenticated file access and database changes. Rotate credentials and secrets stored on affected GMS systems.

Does it have a CVE?

Yes. It is tracked as CVE-2026-109593.Source: CVE-2026-109593

Sources

Tracked as

SonicWall says it will not patch two end-of-life GMS flaws, one rated CVSS 9.1 | cve.now