A management server can remain a customer trust path long after support ends. SonicWall’s new GMS advisory has no patch: identify any remaining deployments, restrict access and plan their replacement.
NEW — SNWLID-2026-0019 · Published and updated November 3, 2026, 08:16:31 UTC · Revision 1.0 · Last verified November 3, 2026. CVE-2026-109593 and CVE-2026-109594.
Applicability and vendor facts
Affected: SonicWall Global Management System (GMS), virtual appliance and Windows deployments, 9.5.2 and all earlier versions. Validate product, platform, build and network reachability; this does not assume any customer operates GMS or establish that SonicOS firewalls are affected.
- CVE-2026-109593: an unauthenticated attacker with network access may read internal GMS files and expose sensitive information. Published CVSS 9.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
- CVE-2026-109594: authenticated SQL injection under specific conditions can affect access to information in the GMS database. Published CVSS 6.8, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. The advisory does not explain the additional conditions.
SonicWall rates the combined advisory Critical. Its API’s separate cvss_version field says 3.0, while both published vectors explicitly say 3.1; scores and vectors above are reported as published. The SQL-injection prose also mentions modification, while its vector assigns integrity impact I:N; that inconsistency remains unresolved.
No GMS fix or vendor workaround
SonicWall says GMS has reached end of life: no remediation or security update will be released. Fixed version: unavailable. Workaround: None. The vendor strongly encourages moving to SonicWall Network Security Manager (NSM). Select a supported, patched NSM release using its own advisories; the notice does not provide a migration target build or detailed migration procedure.
Exploitation and suggested MSP priority
Suggested priority: high; promptly contain reachable affected management instances. This is an MSP recommendation, separate from SonicWall’s Critical rating. The vendor notice does not state confirmed exploitation, and neither CVE appears in the full CISA KEV catalog reviewed for this run. No KEV addition date or federal due date applies to these CVEs in that catalog. Absence from KEV is not evidence that exploitation is impossible.
- Inventory: check customer and shared MSP management environments for GMS virtual appliances or Windows services through 9.5.2. Map managed devices, integrations and credentials without assuming exposure.
- Contain: remove internet and untrusted-network reachability; restrict access to a controlled management network while replacement is arranged. These access controls reduce opportunity but are not a vendor workaround or complete fix.
- Replace: migrate to a supported, patched NSM deployment and retire GMS. Coordinate device-management continuity and customer change windows; do not wait for a GMS patch.
- Verify: confirm the replacement build, management connectivity and integrations, and verify that old GMS services and access paths are removed. Review suspicious access through the incident-response process if indicated. SonicWall publishes no specific compromise-check or credential-rotation mandate in this notice.
Official sources
- SonicWall PSIRT SNWLID-2026-0019
- Official SonicWall advisory API: full affected/fixed matrix, remediation and revision history
- CISA’s official full KEV catalog data
The PSIRT web page is JavaScript based; its own JavaScript identifies the official API used above. This advisory review does not provide an all-clear across the watch’s unresolved coverage gaps.