Summary
- SonicWall GMS versions 9.5.2 and earlier are affected by two newly disclosed vulnerabilities.
- One allows unauthenticated file reading; the other involves SQL injection requiring authenticated access.
- The product has reached end of life, and SonicWall recommends migration to Network Security Manager.
Organisations operating discontinued SonicWall management software face two newly disclosed security vulnerabilities that will remain unpatched, after the vendor confirmed that the affected product has reached the end of its supported lifecycle.
SonicWall disclosed the weaknesses on 3 November, identifying Global Management System (GMS) versions 9.5.2 and earlier as affected.
The vulnerabilities are tracked as CVE-2026-109593 and CVE-2026-109594 and affect software used to manage SonicWall network security infrastructure through a central administrative environment.
The first flaw, rated 9.1 under the Common Vulnerability Scoring System, could allow an unauthenticated attacker with network access to read internal files from a vulnerable GMS installation.
The second, rated 6.8, is a SQL injection vulnerability that could allow an authenticated attacker to access or modify information in the management database under specific conditions.
The different authentication requirements are significant. The first weakness concerns unauthorised file access without a valid account, while exploitation of the second requires an existing level of authenticated access.
SonicWall says it will not provide patches for either issue and has advised customers to migrate to its replacement Network Security Manager platform.
Administrative infrastructure concentrates risk
Central network management applications allow administrators to maintain security policies, monitor devices, review configurations, and coordinate changes across distributed infrastructure.
These functions reduce the burden of managing individual appliances but place sensitive information and administrative capabilities within a smaller number of systems.
Where a central management platform is exposed to unauthorised access, attackers may obtain information about network arrangements or settings that would not normally be available through an ordinary enterprise application.
The severity of a particular vulnerability therefore depends not only on the software flaw but also on the information accessible to the affected management service and its position within the organisation’s network.
CVE-2026-109593 is particularly concerning because SonicWall describes an unauthenticated route to internal file disclosure. An attacker must still have network connectivity to the vulnerable service, so exposure varies according to the controls governing access to the management interface.
CVE-2026-109594 presents a different scenario involving authenticated SQL injection. Such vulnerabilities can interfere with the integrity or confidentiality of database records, depending on the permissions available to the affected application.
The available disclosures do not establish that either flaw has been actively exploited.
Unsupported products complicate vulnerability management
Software can remain operational after its vendor stops issuing security updates. In infrastructure environments, administrators may retain established management platforms because migration involves compatibility testing, monitoring changes, and coordination across multiple locations.
That continuity creates a growing security burden when vulnerabilities are discovered after the formal support period ends.
Unlike a supported product, an end-of-life platform may provide no vendor-issued correction, even when the weakness is well documented and sufficiently serious to require action.
A discontinued management application may remain connected to the wider security estate even after administrators adopt another platform. Migration planning therefore includes identifying residual integrations and accessible interfaces, since an unused service can remain reachable if its host and network permissions are not retired.
Network restrictions can reduce exposure by limiting access to management interfaces, but they do not remove the vulnerable code. They also depend on accurate knowledge of which networks and users can reach the affected application.
Replacing an unsupported platform can require planning around policy migration, device compatibility, operational monitoring, and administrative access arrangements.
Those dependencies are particularly important where security appliances protect distributed sites or infrastructure supporting regulated operations.
The decision to retain unsupported software therefore extends beyond routine patch management. It involves asset lifecycle planning, procurement, operational continuity, and the organisation’s tolerance for vulnerabilities that cannot be corrected through normal maintenance.
SonicWall’s advisory identifies the affected GMS versions and recommends migration to Network Security Manager. No remediation or security update will be released for the two newly disclosed vulnerabilities in the discontinued product.
