SonicWall Says It Will Not Patch Two Bugs in Its End-of-Life GMS Console. One Reads Internal Files With No Login.
If you still run SonicWall Global Management System, version 9.5.2 or earlier, there is no fix coming. SonicWall says "no remediation or security update will be released" for two newly disclosed flaws, and tells customers to move to Network Security Manager. The practical answer is to plan the migration, and until it happens, keep the GMS interface off the internet and off any network an outsider can reach.
What was disclosed
GMS is the console that manages many SonicWall appliances from one place. SonicWall has replaced it with Network Security Manager. Both flaws affect GMS 9.5.2 and earlier, and both were reported by researchers at Pentest-Tools, per BleepingComputer's report of SonicWall's advisory, SNWLID-2026-0019.
CVE-2026-109593 needs no authentication. An attacker with network access to a vulnerable instance can read internal files and steal sensitive information.
CVE-2026-109594 needs high privileges. An attacker who has them can read or modify data in the GMS database through a low-complexity SQL injection.
The report gives no CVSS scores and no end-of-life date, and neither do we.
Why the first one matters more than its label
A management console holds the keys to the thing it manages: appliance configurations, credentials and policy. A no-login file read on that console is a way to get at those, and the only gate is whether the attacker can reach it over the network. The second bug needs high privileges, so it is mostly a second step for someone already inside.
What is and is not known
BleepingComputer does not report exploitation of these two flaws. It does note that SonicWall products are a frequent target. It lists SMA1000 bugs exploited this year, and says CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog over four years, 13 of them also used by ransomware gangs. That is the neighborhood, not evidence about these two.
We searched our copy of CISA's catalog and our indexes for the two new CVE numbers and the advisory. We found no entry for either bug and no indicators, so there is nothing to ingest. Our copy does show the SMA1000 entries the report mentions, including CVE-2026-15409 and CVE-2026-83548.
What to do
- Find out whether you run GMS and which version. Version 9.5.2 or earlier is in scope.
- Take the interface off the internet. If administrators need it remotely, put it behind a VPN or an allowlist.
- Plan the move to Network Security Manager. An unpatched console stays unpatched.
- While it remains, treat its stored credentials as exposed to anyone who can reach it, and rotate them when you migrate.
Limits
We read BleepingComputer's report of SonicWall's advisory. We did not read the advisory itself. We did not test either bug.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.