SonicWall GMS Vulnerability CVE-2026-109593: Critical File Read Flaw in End-of-Life GMS 9.5.2 and Earlier, No Fixed Version, and How to Move to NSM
SonicWall has disclosed two flaws in GMS 9.5.2 and earlier, including CVE-2026-109593 (CVSS 9.1), which needs no login. GMS reached end of support on September 30, 2026 and no fixed version is listed. Here is what is confirmed and what to do this week.
Where Worldwide
On this page 6 sections
SonicWall has disclosed two security flaws in its Global Management System (GMS), the software many companies use to run all their SonicWall firewalls from one console, and no fixed version is listed. GMS reached end of support on September 30, 2026. If you still run it, the server that manages your firewalls now has a critical-rated flaw that needs no login, and SonicWall's own lifecycle policy says unsupported products get no more updates.
What happened with SonicWall GMS
On Tuesday, November 3, 2026, SonicWall published two CVE records that both point to its security advisory SNWLID-2026-0019:
- CVE-2026-109593, CVSS 9.1 (critical). An unauthenticated attacker with network access to GMS 9.5.2 or earlier may be able to read internal GMS files and expose sensitive information. The attacker does not need an account.
- CVE-2026-109594, CVSS 6.8 (medium). A SQL injection flaw in what the record calls "End-of-Life SonicWall GMS 9.5.2 and earlier versions." Under specific conditions, an attacker who is already logged in could read or change information in the GMS database. CISA's scoring in the record marks it as needing high privileges.
Both records list GMS on Windows and Linux, versions 9.5.2 and earlier, as affected.
What is confirmed and what is not
Confirmed from SonicWall's own records and pages:
- Affected range: GMS 9.5.2 and earlier, on Windows and Linux.
- Both CVE records carry the tag "unsupported-when-assigned," which means the product was already out of support when the flaw got its CVE number. Neither record names a fixed version.
- SonicWall's GMS end-of-life announcement gives September 30, 2026 as the last day of support. From that date SonicWall stops technical support, firmware updates and upgrades for GMS.
- SonicWall's GMS transition FAQ says security updates were only provided until end of support, and: "You can continue to use GMS, but it will not receive support after the EOS date."
Reported, but we could not confirm it ourselves:
- The Hacker News quotes the advisory as saying: "The affected product has reached End-of-life (EoL)" and "no remediation or security update will be released for these vulnerabilities," and reports that SonicWall strongly encourages GMS users to move to Network Security Manager (NSM). The advisory page only loads in a browser running JavaScript, so we could not read its text directly. The quote fits SonicWall's published lifecycle policy, but until you read the advisory yourself, treat the exact wording as reported.
Not known:
- Whether either flaw is being exploited. None of the sources we opened report attacks as of November 4, 2026.
- Which files CVE-2026-109593 exposes. The CVE record says "internal GMS files" and "sensitive information" and gives no detail.
- Whether SonicWall will make an exception and release a fix.
Why a firewall management server matters for a business network
A management console like GMS is not just another server. It usually holds the configuration for every firewall it manages, and often the connection details it uses to reach them. An unauthenticated file read on that machine is the kind of foothold attackers look for, because what they read there can lead to the devices protecting your whole network.
The risk depends on who can reach GMS. If it is reachable from the internet, anyone can try CVE-2026-109593. If it sits on an internal network that only admins can reach, an attacker first needs a foothold inside. Either way, this server will not get a fix, so the long-term answer is to replace it.
What to do this week
| Step | What to do | How to check |
|---|---|---|
| 1. Find out if you run GMS | Ask whoever manages your SonicWall firewalls, including your IT provider, whether a GMS server exists | Look for a Windows or Linux server or VM running GMS. The version is shown in the GMS console. 9.5.2 or earlier is affected |
| 2. Take it off the internet | If the GMS web interface can be reached from outside, block it today | Try the GMS address from an outside connection, or review the firewall rules that forward traffic to it |
| 3. Limit inside access | Allow only named admin workstations or a VPN to reach GMS | Add a firewall rule that allows only those addresses and blocks everything else |
| 4. Cut down admin accounts | CVE-2026-109594 needs a logged-in user, so remove unused GMS accounts and change shared passwords | Review the user list in the GMS console |
| 5. Rotate secrets if it was exposed | If GMS was reachable from the internet, assume its files could have been read and change the passwords and shared secrets it stores or uses | Change firewall admin passwords and any credentials saved in GMS |
| 6. Plan the move to NSM | SonicWall's named replacement is NSM 3.0, as SaaS or On-Prem | Read the SonicWall transition FAQ before you choose (details below) |
| 7. Set a shutdown date | Put a date on switching GMS off, not just "soon" | Put it on the calendar with a named owner |
Steps 2 to 5 are our advice for reducing risk while you migrate. SonicWall's recommendation is to move to NSM.
What the move to NSM involves
From SonicWall's GMS transition FAQ:
- NSM SaaS: SonicWall hosts and maintains it. GMS configurations, licenses and reporting data cannot be moved across.
- NSM On-Prem: you run the servers on ESXi, Hyper-V, KVM or Azure. A GMS configuration snapshot can be imported, but logs and reporting data are not migrated. NSM On-Prem needs a new serial number, because existing GMS serial numbers cannot be used to deploy it.
- Only firewalls with active support can be moved to NSM, and unused node licenses do not transfer.
- Group settings such as group policies have to be rebuilt in NSM using device groups and templates.
If you keep old firewall logs for compliance, export or archive them before you shut GMS down, because neither NSM option brings them across.
SonicWall GMS questions people are asking
Is there a patch for CVE-2026-109593?
No fixed version is listed. GMS reached end of support on September 30, 2026, and SonicWall's FAQ says it gets no support after that date. The Hacker News reports the advisory says no remediation will be released.
Which SonicWall GMS versions are affected?
GMS 9.5.2 and earlier, on both Windows and Linux.
Is the SonicWall GMS vulnerability being exploited?
That is not known. None of the sources we opened report attacks as of November 4, 2026. A flaw that needs no login and will not be fixed is still worth treating as urgent.
Does GMS stop working after end of life?
No. SonicWall says you can keep using GMS and your licenses keep working for your current version, but it gets no updates or support.
What replaces SonicWall GMS?
SonicWall Network Security Manager (NSM) 3.0, offered as SaaS or On-Prem.
Do GMS licenses transfer to NSM?
Not directly. SonicWall says GMS Comprehensive licenses cannot be transferred, unused node licenses do not move, and NSM On-Prem needs a new serial number. Talk to your SonicWall sales contact.
Do I need to update my SonicWall firewalls too?
These two flaws are in GMS, not in firewall firmware. SonicWall says firewalls under an active hardware support contract are still supported, so keep their firmware current as usual.
The bigger lesson
An end-of-life date is a security date. Once support ends, the next flaw found in that product stays open for good, and the systems that manage everything else are the worst place for that to happen. Keep a list of the software your network depends on, write down each end-of-support date, and plan the replacement before the date arrives, not after the first unpatched flaw shows up.
Need help locking down or replacing your firewall management? See our security hardening services or request a quote.
Get security alerts like this by email, along with our free checklist, at EPE Security Alerts.
Sources: SonicWall GMS EOL Announcement; SonicWall GMS End of Life and NSM Transition FAQ; CVE-2026-109593 record; CVE-2026-109594 record; The Hacker News report.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Rosstat Cyberattack: Russia's Statistics Agency Is Still Restoring Systems, What Is Confirmed and What Businesses Should Check
Rosstat says it is still restoring systems after cyberattacks from October 29 to November 1, 2026. Hackers cla...
Ransomware Business Continuity: Why Backups Alone Won't Keep Your Company Running, and What to Do This Week
Backups can bring systems back, but they do not keep work moving during the outage. Here is what Japan's IPA l...
Sshole SSH Vulnerability (CVE-2026-123158): Exploit Attempts Hit Honeypots, Which Alpine Linux Servers Are Exposed, and the Fixed Versions to Install
An OpenSSH flaw called Sshole can let attackers skip the password on some Alpine Linux servers, and honeypots...
