SonicWall issued a security notice on November 3 for two severe flaws in its Global Management System, and it is not offering a patch. The company is telling administrators to retire the end-of-life tool instead of waiting for a fix.
Fail-Open Access Checks in SonicWall GMS 9.5.2 and Earlier
The notice covers SonicWall Global Management System (GMS) version 9.5.2 and earlier. The first flaw, CVE-2026-109593, carries a CVSS score of 9.1. SonicWall says the access checks in the affected code fail open, so an unauthenticated attacker with network access can read internal GMS files. That could expose sensitive information held by the management system.
A fail-open check is one that grants access when the verification step breaks or is missing, rather than denying it. The result here is that an attacker does not need credentials to reach files that should be restricted to authorized administrators.
Second SonicWall Flaw CVE-2026-109594 Affects Database Queries
The second flaw, CVE-2026-109594, sits in how the old code builds database queries. Details on this one are limited in the available reporting, and no CVSS score has been given for it. SonicWall describes both flaws as severe and has grouped them in a single notice.
What SonicWall Says About Exploitation and Fixes
SonicWall says it has seen no active attacks in customer networks and that no public exploit code exists. That assessment applies to the moment of the notice. Because the flaws are unpatched and will remain so, the situation will not improve by itself over time; it would worsen if researchers or attackers produce exploit code later.
The company’s recommendation is to retire the tool. Where administrators cannot migrate right away, the notice advises restricting network access to GMS in the meantime. Limiting who can reach the system limits who can attempt the unauthenticated file read.
Why End-of-Life Status Changes the Calculation
Normally a critical vulnerability prompts a patch cycle. Here the affected software is old code that the vendor no longer maintains, so the cycle does not apply. Customers have two choices: remove the product from service or isolate it. The notice makes the recommendation to retire the tool explicit, which signals that SonicWall does not plan to invest in repairing it.
Exposure for Firewall Fleets Managed Through GMS
GMS is used to manage fleets of SonicWall firewalls from a central point. A compromised management system could expose configuration data and could let attackers affect the managed devices. The first flaw, as described, permits file reads rather than command execution, but configuration files and stored data on a management server can hold the information an attacker needs for a follow-on attack on the firewalls.
Firewalls are a recurring target for attackers because they sit at the network edge and often hold credentials, rules and VPN settings. A central tool that touches many of them multiplies the value of any access. Organizations that still run GMS therefore have a reason to confirm where the system sits on the network and who can reach it.
The disclosure also leaves a practical migration question. Organizations with GMS 9.5.2 or earlier need a supported replacement for central management, and the time required to move a large firewall fleet is not trivial. During that period, network restrictions are the only protective step the notice provides.
What Administrators Running GMS 9.5.2 Should Do Now
The guidance is direct: plan the move off GMS, and until it happens restrict network access so that only trusted administrative hosts can reach the system. Administrators can also check whether the management interface is reachable from the internet or from broad internal segments and close that exposure first.
Products that outlive their support period can keep running for years, but any serious flaw found afterward arrives with no remedy from the vendor. For GMS, that moment has come, and the choice now rests with the organizations that still depend on it.
