Do Son 
TL;DR
SonicWall issued a security notice on November 3, 2026. The alert warns of two severe SonicWall GMS vulnerabilities in old code. The worst bug holds a 9.1 CVSS score. It lets attackers read files without a password. Therefore, IT teams must act fast. Admins should retire the tool right away to stay safe.
- Product: SonicWall Global Management System (GMS)
- Vulnerabilities: 2 flaws (CVE-2026-109593, CVE-2026-109594)
- Highest severity: 9.1 (Critical · CVSSv3)
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-109593 | 9.1 | CWE-636 | Not exploited |
| CVE-2026-109594 | 6.8 | CWE-89 | Not exploited |
Why It Matters
SonicWall tools protect more than 500,000 groups worldwide. Many firms used this tool to control their firewalls. Flaws in admin tools put networks at high risk. Intruders could view private files. They could also breach key data. In addition, attackers could lock staff out of the network.
Fortunately, SonicWall confirmed no active attacks in customer networks. Furthermore, researchers have shared no public exploit code for these bugs.
How the Attack Works
The notice details two bugs in system files and database queries.
Unauthenticated File Disclosure
First, CVE-2026-109593 allows file leaks without a login. The official SonicWall security advisory explains the risk. It warns that “An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.” The bug occurs when access checks fail open.
Authenticated SQL Injection
Second, CVE-2026-109594 is an SQL injection flaw. In some cases, a user with login rights can send bad SQL commands. In turn, attackers can view or change records in the main database. They can steal private logs.
Affected Versions
These SonicWall GMS vulnerabilities affect Virtual Appliance and Windows builds on version 9.5.2 and older.
Patch and Mitigation Steps
Because the tool reached end-of-life, SonicWall will release no patch. The vendor confirmed: “As a result, no remediation or security update will be released for these vulnerabilities.” Consequently, admins should take old hosts offline today. Firms should move to Network Security Manager right now to stay safe. Teams must also block web ports to stop bad traffic.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
