SonicWall issued a warning about two flaws in Global Management System (GMS), used to centrally manage thousands of the company's security appliances. The first, CVE-2026-109593, lets an unauthenticated attacker with network access read internal files and steal sensitive information. The second, CVE-2026-109594, lets an attacker with high privileges access or modify data in the GMS database through SQL injection.
The flaws, reported by Pentest-Tools researchers, affect GMS 9.5.2 and earlier. SonicWall said the product has reached end of life, so "no remediation or security update will be released" for them.
What to do: SonicWall recommends that organizations still using GMS move to Network Security Manager (NSM), which replaced it. Attackers have exploited several SonicWall vulnerabilities since the start of the year, some before patches existed.