SonicWall disclosed two flaws in Global Management System (GMS) 9.5.2 and earlier on 3 November 2026 in bulletin SNWLID-2026-0019. GMS is end of life: the CVE-2026-109594 record calls it End-of-Life, and CERT-FR, summarising the bulletin, says these versions will get no further security patches. Your job is therefore not to patch but to isolate the console and move off it.
GMS is the management console for SonicWall firewalls. Both CVE records list Windows and Linux as platforms and 9.5.2 and earlier as affected. This playbook gives the order of work, from cutting network reach today to retiring the console after migration.
- Vendor fix for 9.5.2 and earlierNot seenCERT-FR, citing SonicWall, says these versions are end of life with no further security patches4 Nov 2026
- Listed in CISA KEVNot seenNot in catalogue version 2026.11.044 Nov 2026
- Exploitation, CISA SSVC entryNot seenThe CISA Coordinator entries list exploitation as none for both CVEs3 Nov 2026
- Automatable, CVE-2026-109593YesThe same CISA entry marks the unauthenticated file read as automatable3 Nov 2026
What Do the Two GMS Flaws Allow?
CVE-2026-109593 lets an unauthenticated attacker with network access read internal GMS files. SonicWall classes the weakness as CWE-636, Not Failing Securely, and the record does not say which files. CVE-2026-109594 is a SQL injection that needs a logged-in attacker and, in the record’s words, specific conditions.
| Item | CVE-2026-109593 | CVE-2026-109594 |
|---|---|---|
| Access needed | None, only network reach | An authenticated user |
| Effect | Read internal GMS files | Read or modify data in the GMS database |
| Weakness | CWE-636 | CWE-89 |
| CVSS 3.1, from CISA ADP | 9.1 Critical | 6.8 Medium |
| CVSS 4.0 | None in the record or NVD | None in the record or NVD |
| Credit | Matei Badanoiu, Pentest-Tools.com | Matei Badanoiu and Andrei Lungu, Pentest-Tools.com |
SonicWall is the CNA for both records, but the 9.1 and 6.8 scores sit in the CISA ADP container, so they are CISA’s scoring and not SonicWall’s. NVD showed both records as Awaiting Analysis on 4 November 2026. The file-read vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, which rates availability high even though the description speaks only of reading files.
Why Is 9.5.2 the Awkward Version?
On 11 August 2026 SonicWall’s notice SNWLID-2026-0011 listed six GMS flaws, among them an unauthenticated command injection in the Dispatcher Service rated 9.4. It told customers to upgrade to 9.5.2 or higher. On 3 November the same 9.5.2 appeared in the affected range of two new records.
SonicWall announced the GMS end of life on 5 May 2025. Its lifecycle pages set 30 September 2026 as both the last day of support and the end of support. Both new records carry the tag unsupported-when-assigned, which marks a product the vendor no longer supports. A site that followed the August advice runs the release SonicWall named as the fix for the six August flaws, yet it sits in the new affected range.
How Could the Two Flaws Combine?
The records do not link the two flaws. Our reading is that a console which manages firewalls plausibly stores credentials and configuration files, so an unauthenticated file read may be worth more than its score. The record does not say which files are readable, so treat this as a hypothesis, not a finding.
The weakness class also matters for detection. A fail-open file read may leave little trace in application logs, so network-level records of who reached the GMS web port carry more weight than GMS’s own logs. That is our advice.
Migrate or Isolate: What to Do, in Order
The order puts exposure first, because a migration takes longer than a firewall rule change. Step 4 follows SonicWall’s transition FAQ for Network Security Manager (NSM). The other steps are our advice.
- Find every GMSList each console by version, host and platform, and who can reach its web interface. Include Linux hosts: the August notice named Virtual Appliance and Windows, but the new records list Windows and Linux.
- Cut network reach todayAllow the management interface only from an admin jump host or VPN, and block it from the internet and user networks. Then test from a user network and from outside: the step is done only when the web port does not answer there.
- Watch it while it waitsIn firewall logs, alert on any source other than the jump host that connects to the GMS web port. In the GMS logs, watch for repeated failed logins and database errors.
- Plan the move to NSM 3.0Choose NSM SaaS or NSM On-Prem. On-Prem needs a new serial number and GMS 9.4.4 for the data import.
- Rotate what GMS holdsAfter isolation, change the credentials and keys GMS stores for managed firewalls, and the admin accounts.
- Cut over and retireMove the firewalls, power off GMS, remove its firewall rules and accounts, and record the retirement date.
Step 2 is the real control while GMS stays up. Our glossary entry on network segmentation explains the pattern, and the technique page on exploiting public-facing applications shows why an exposed management port draws attacks. If your console is reachable from the internet, treat step 2 as an emergency, not a plan.
What Limits Does the Move to NSM Have?
SonicWall’s FAQ, last updated on 5 June 2025, names NSM 3.0 as the replacement. No configuration can move to NSM SaaS, and reporting data does not move to either NSM form. Only firewalls with active support can be moved, and GMS licences cannot be transferred.
The FAQ says the data import to NSM On-Prem needs GMS 9.4.4, but this bulletin concerns 9.5.2 and earlier. Ask SonicWall which snapshot path applies to 9.5.x before you plan dates. Our entries on patch management and the exploited vulnerability response playbook cover the surrounding routine. For an earlier SonicWall case see CVE-2024-40766.
What Would Change This Advice?
A CISA KEV listing for either CVE, a SonicWall statement that a fix will ship, or public exploit code would move step 2 from today to within the hour. We will update this post if the SonicWall bulletin or the catalogue changes.