Companies that rely on SonicWall’s now-outdated Global Management System (GMS) may soon find themselves in a cyber pickle after the company disclosed a pair of vulnerabilities – one of them critical – in the platform.
CVE-2026-109593 could lead to unauthenticated access to internal files and requires neither privileges nor user interaction.
CVE-2026-109594 features a CVSS score of 6.8 and could allow an authenticated attacker to access or modify data stored in the GMS database.
Both vulnerabilities affect GMS versions 9.5.2 and earlier.
However, since SonicWall GMS is now end-of-life, the company said it will not patch the platform; instead, customers are being advised to upgrade to SonicWall’s latest product.
“The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities,” SonicWall said in its 3 November advisory.
“Organisations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM).”
SonicWall has made several headlines in the last 12 months, with hackers frequently targeting vulnerabilities in its network security devices.
The company disclosed a pair of vulnerabilities in its SMA1000 series devices in September, with exploitation occurring before the disclosure was made, and another two zero-days in July; again, both were well and truly on threat actors’ radar.
WatchTowr CEO and founder Benjamin Harris noted at the time that SonicWall’s disclosure was fuelling a “sense of dread” due to two sobering points: “both were being exploited as zero-days before fixes were available, and together they offer a plausible path to remote code execution from the internet”.
“This is a familiar pattern for SonicWall appliances and Secure by Design pledgees in general. Attackers of every calibre (literally every calibre) continue to target SSL VPN appliances, and the trend is not changing. As always, when something is confirmed as already exploited in the wild, patching is the bare minimum, and breach should be assumed.”
So far, there is no indication that CVE-2026-109593 and CVE-2026-109594 are being exploited, but that is likely only a matter of time.
Follow SonicWall’s advice and upgrade now.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
