SonicWall disclosed two flaws in its end-of-life Global Management System (GMS) 9.5.2 and earlier. Pentest-Tools found them. They won’t be fixed.
The bugs
- CVE-2026-109593: unauthenticated attackers with network access can read internal files
- CVE-2026-109594: high-privilege attackers can read or change the GMS database with SQL injection
“The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released.” SonicWall wants everyone on Network Security Manager (NSM).
My take
A management console that controls a fleet of firewalls is a crown jewel. If you still run GMS, get it off any network an attacker could reach today and plan the move to NSM. SonicWall bugs get exploited a lot. I put together a how-to below for finding and fencing off end-of-life consoles.
God Bless, and Needs Garlic!
