I’M UNDER A CYBER ATTACK

Alert

Logo de SonicWall

Alert 2026-145 Critical vulnerability in SonicWall Global Management System

Affected product(s): 

ProductAffected versions
SonicWall Global Management System (GMS), Windows and virtual appliance (Virtual Appliance)9.5.2 and earlier

There is no fixed version in the GMS 9.x branch: the product is unsupported, and the vendor advises migrating to SonicWall Network Security Manager (NSM).

Description

A critical-severity vulnerability (CVSSv3.1 9.1 – CRITICAL) has been published for SonicWall Global Management System (GMS), a console for deploying and managing SonicWall security appliances from a central interface. The vulnerability has been assigned the identifier CVE-2026-109593 and is a failure to fail securely (CWE-636). The published CVSS vector is exactly CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.

According to advisory SNWLID-2026-0019 dated Nov 3, 2026, an unauthenticated attacker with network access to a GMS 9.5.2 or earlier installation could read internal GMS files and expose confidential information. The vector also scores a high availability impact (A:H), although the official description focuses on file reading; it is reproduced verbatim. The CVE record marks the assignment as unsupported-when-assigned.

The same advisory lists CVE-2026-109594, a medium-severity vulnerability (CVSSv3.1 6.8 – MEDIUM) involving a post-authentication SQL injection (CWE-89). The published vector is exactly CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. The CVE record states that, under certain conditions, an authenticated attacker could access or modify information in the GMS database; however, the vector assigns no integrity impact (I:N) and requires high privileges (PR:H).

The vendor stated that GMS has reached the end of its useful life and, as a result, will not release remediation or security updates for these flaws. The official recommendation is to migrate to SonicWall Network Security Manager (NSM), which is not reported as affected. As of Nov 6, 2026, no exploitation is known. They do not appear in catalogs of known exploited vulnerabilities. The EPSS score for CVE-2026-109593 is 0.52%, and the score for CVE-2026-109594 is 0.38% (both as of Nov 6, 2026).

Mitigation

The vendor has not published a patch or temporary measure for GMS 9.5.2 and earlier. Until the migration is complete, it is recommended to:

  • Do not expose the GMS console to the Internet; restrict network access to trusted administrative networks.
  • Inventory GMS installations (Windows and virtual appliance) that are still in use, including any overlooked instances.
  • Treat consoles reachable from untrusted networks as an immediate operational risk: reading internal files requires no credentials.
  • Restrict administrative accounts (particularly relevant for CVE-2026-109594) and review anomalous access.

Solution

The solution specified by the vendor is to migrate from SonicWall GMS to SonicWall Network Security Manager (NSM) and decommission GMS 9.5.2 and earlier installations. No fixed version of GMS is available for these vulnerabilities.

For information on how to update, visit the following link:

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

Additional information: