Security AlertHigh
SonicWall leaves two end-of-life GMS flaws unpatched
Nov 5, 2026 · Summarized by Fundy Tech from 3 sources
The 30-second version
SonicWall says two flaws in end-of-life Global Management System software will not be fixed. Customers are being told to move to SonicWall Network Security Manager.
Key points
- The flaws affect SonicWall GMS 9.5.2 and earlier.
- CVE-2026-109593 is an unauthenticated file-read bug.
- CVE-2026-109594 is a SQL injection flaw in the GMS database.
- SonicWall says the product reached end-of-life in October 2025.
Why it matters
If you still run SonicWall GMS, these bugs will not get a patch. That means the safer move is to plan an upgrade rather than wait for remediation. Small businesses should check whether any files or database records exposed through GMS could be sensitive.
Who’s affected: SonicWall GMS 9.5.2 and earlier
What to do
- Check whether you use SonicWall GMS 9.5.2 or earlier.
- Plan a move to SonicWall Network Security Manager.
- Limit network access to legacy management systems.
- Review whether any stored files or database data need extra protection.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.