SonicWall GMS vulnerabilities will not receive security patches
SonicWall Global Management System (GMS) will not receive fixes for two recently disclosed vulnerabilities because the product reached end of life, according to a Nov. 5, 2026, report by Heise. Administrators use GMS in corporate networks to manage IT security appliances, the report said.
The flaws are identified as CVE-2026-109593 and CVE-2026-109594. Heise reported that GMS is affected through version 9.5.2. CVE-2026-109593 is rated critical and allows an attacker to read internal GMS files without authenticating. CVE-2026-109594 is rated medium and involves SQL injection, an attack that inserts database commands through an application. It requires a login and can allow an attacker to change data in the GMS database, according to the report.
A CERT-Bund advisory said the vulnerabilities can expose information and enable SQL injection attacks. Heise reported that SonicWall had not provided indications that attackers were already exploiting the flaws.
Because GMS is no longer supported and will not receive security patches, Heise said administrators should upgrade to SonicWall Network Security Manager.