SonicWall has disclosed two vulnerabilities in its retired Global Management System, or GMS, which centrally manages security appliances. Its November 3 advisory lists 9.5.2 and every earlier version as affected. Both the virtual appliance and Windows deployments are included. No fixed GMS release will be provided.

Evidence status: vendor-disclosed vulnerabilities, with no exploitation reported in the reviewed advisory or reporting. Attacks on other SonicWall products do not establish exploitation of these two GMS flaws.

Network reachability matters before authentication

The two issues have different prerequisites:

  • CVE-2026-109593: an attacker with network access to GMS can read internal files without authenticating. SonicWall says those files may expose sensitive information. The advisory gives no complete inventory of readable files.
  • CVE-2026-109594: an authenticated attacker with high privileges can, under specified but unexplained conditions, access or modify GMS database information. This is SQL injection, where input improperly changes a database command.

Keep those conditions separate. The database issue is not described as an unauthenticated takeover. Conversely, a login requirement on the management interface does not address the separate unauthenticated file-read flaw.

SonicWall credits Matei “Mal” Badanoiu of Pentest-Tools.com for the file-read report, and Badanoiu and Andrei Lungu for the database issue. The public advisory describes possible impact; it supplies no incident count or evidence that an individual installation was accessed.

Retirement changes the repair plan

The advisory’s Workaround section says “None.” Its fixed-software table says no fix is available because the product has reached end of life. Installing the last GMS version therefore cannot satisfy this advisory’s remediation requirement.

SonicWall recommends moving to Network Security Manager, or NSM, its replacement management platform. Sergiu Gatlan’s November 4 BleepingComputer report independently reports the warning, while relying on SonicWall for the technical findings.

For an organization still running GMS, the practical work is to identify its deployments and arrange a supported replacement or retirement. Include Windows installations in that inventory rather than checking only appliance images.

While arranging that transition, restrict management access to the administrators and networks that actually need it. Removing unnecessary network reachability reduces opportunities to reach the file-read flaw. That is an exposure-reduction measure, not a vendor-provided workaround or a repair. It also leaves risk from an attacker who already has access inside an allowed network.

If available logs or other evidence suggest unauthorized access, preserve them and investigate what the management system held. The advisory alone does not establish which credentials, configurations or database records were exposed. Any resulting rotation or recovery should follow those findings.

Caveat: SonicWall is the affected supplier and sells the proposed replacement; its advisory provides neither a patched GMS version nor a complete migration procedure.