# SZB-6be53914c8: SonicWall says it will not patch two end-of-life GMS flaws, one rated CVSS 9.1

SonicWall warned of two vulnerabilities affecting end-of-life GMS 9.5.2 and earlier and said it will not release patches. The item describes CVE-2026-109593 (CVSS 9.1) as an unauthenticated file read flaw that lets a network-accessible attacker read internal GMS files.

- Type: Early warning
- Kind: Vulnerability
- Vendor: SonicWall
- Product: Global Management System (GMS)
- Status: Confirmed
- Sources: 4 distinct
- First seen: 2026-11-03 17:02 UTC
- Confirmed: 2026-11-04 17:22 UTC

Written by a model from the sources below. Verify against them.

## What to do

- Identify any GMS 9.5.2 or earlier deployments and plan a migration to a supported version
- Restrict network access to GMS management interfaces
- Review GMS logs for unauthenticated file access and database changes
- Rotate credentials and secrets stored on affected GMS systems

## Timeline

- 2026-11-03 17:01 UTC: Made public by Mastodon
- 2026-11-03 17:02 UTC: First seen by cve.now
- 2026-11-04 17:22 UTC: Record last updated
- 2026-11-04 17:22 UTC: Confirmed as CVE-2026-109593

## Evidence (4 sources)

- 2026-11-03 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117553579186377859): “Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially ...” (+1 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117553579480246902))
- 2026-11-03 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117555141839836655): “The SonicWall GMS vulnerabilities patch notice details two critical SonicWall GMS vulnerabilities.”
- 2026-11-04 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117555482317328330): “Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when processing an EPC Client update.”
- 2026-11-04 · Press · [The Hacker News](https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html): “SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-6be53914c8&body=https%3A%2F%2Fcve.now%2FSZB-6be53914c8%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-6be53914c8

### Has SonicWall confirmed it?

Mastodon, Mastodon and Mastodon report a possible compromise. None of the sources says it happened.

Source: https://mastodon.social/@EUVD_Bot/117553579186377859, https://infosec.exchange/@DailyCyberSecurity/117555141839836655, https://mastodon.social/@EUVD_Bot/117555482317328330, https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html

### What should SonicWall users do?

Identify any GMS 9.5.2 or earlier deployments and plan a migration to a supported version. Restrict network access to GMS management interfaces. Review GMS logs for unauthenticated file access and database changes. Rotate credentials and secrets stored on affected GMS systems.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-109593.

Source: https://cve.now/CVE-2026-109593

## Tracked as

- [CVE-2026-109593](https://cve.now/CVE-2026-109593.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-6be53914c8
Site guide for agents: https://cve.now/llms.txt