CVE-2026-109593 allows unauthenticated actors on a network to read internal files from SonicWall Global Management System (GMS) installations running version 9.5.2 and earlier, and SonicWall says it will not patch those systems because GMS has reached end-of-life.
What the flaws are and which systems are affected
SonicWall disclosed two security flaws affecting its Global Management System (GMS) and said the affected product will not receive fixes. The company identified the first of the two flaws this week as CVE-2026-109593. According to the advisory, that vulnerability enables unauthenticated attackers with network access to vulnerable instances — specifically systems running GMS 9.5.2 and earlier — to steal sensitive information by reading internal files.
GMS is the management platform that helps IT administrators deploy and manage large numbers of SonicWall security appliances from a single interface. SonicWall told customers the product has reached end-of-life and therefore will not be updated for these newly disclosed issues.
SonicWall's guidance to customers
SonicWall warned customers directly in its advisory: "The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities." The company went on to advise a migration path: "Organizations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM)." The Network Security Manager (NSM) is SonicWall's replacement management platform for GMS.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleExploitation context: recent SonicWall zero-days and CISA tracking
The advisory arrives against a backdrop of active exploitation of SonicWall products this year. SonicWall has asked customers to patch multiple SMA1000 zero-days earlier in 2026 — two zero-days (CVE-2026-15409 and CVE-2026-15410) in February and the same two CVEs in July — and it also patched three other SMA1000 flaws that were exploited as zero-days in September (CVE-2026-83548 and CVE-2026-83549) and October (CVE-2026-102255). The company noted attackers often target SonicWall vulnerabilities in the wild.
Over the last four years, the US Cybersecurity and Infrastructure Security Agency (CISA) added 19 SonicWall vulnerabilities to its list of actively exploited flaws; 13 of those 19 were also abused by ransomware gangs, the advisory observed.
Who runs GMS and what upgrade means in scale
SonicWall said GMS customers are part of a broad installed base: the company serves more than 500,000 customers, including small and medium-sized businesses, large enterprises, and government agencies, across more than 215 countries and territories through a network of over 17,000 partners. For that number of deployments, SonicWall's recommendation is an upgrade to NSM — the supported management platform — because GMS is now out of maintenance.
What this means for technologists, procurement teams, and the public
- Technologists and security teams: Systems running GMS 9.5.2 and earlier are exposed to at least one identified information-disclosure vulnerability (CVE-2026-109593) and will not receive remediation from SonicWall. Teams must weigh the risk of continued operation against the advised upgrade to NSM.
- Procurement and IT operations leaders: Organizations that support numerous SonicWall appliances through GMS should plan for migration to NSM or other management strategies, noting SonicWall's explicit statement that no security updates will be released for the end-of-life product.
- The general public and customers: Because SonicWall reported attackers frequently target SonicWall vulnerabilities and CISA has documented multiple exploited SonicWall flaws — many tied to ransomware abuse — customers should be aware of the increased risk profile for unpatched, end-of-life management systems.
SonicWall's advisory draws a clear line: GMS is end-of-life and at least one dangerous flaw has been publicly documented for versions 9.5.2 and earlier. For the hundreds of thousands of devices and the partners that manage them, the immediate imperative SonicWall sets out is migration to the vendor's supported management platform, NSM, because the vendor will not be shipping patches for GMS. Whether organizations comply — and how quickly they can do so across large deployments — will determine how many networks remain exposed to the vulnerabilities SonicWall has described.
Source: BleepingComputer — SonicWall warns of unpatched flaws in end-of-life GMS software
