CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

SonicWall GMS 9.5.2 and earlier (end of life): post-authentication SQL injection, no fix (6.8)

cve · CVE-2026-109594 single-source

Coverage
1
first 2026-11-05 → last 2026-11-05
Latest activity
2026-11-05
SonicWall GMS 9.5.2 and earlier: unauthenticated file read, no fix will ship; replace with NSM
Peak priority
routine
1 routine
Targets
·
no sector or region stated
Sources cited
4
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-109594, newest first. Check the date before acting on an older one.

  • Find every SonicWall GMS instance on 9.5.2 or earlier, Virtual Appliance or Windows, cut its reachability from untrusted networks and schedule its replacement with Network Security Manager, because SonicWall will release no fix and names no workaround.
    2026-11-05CVE-2026-109593 +1

Defender insights

What each entry about CVE-2026-109594 tells a defender to do, newest first.

2026-11-05ROUTINESonicWall GMS 9.5.2 and earlier: unauthenticated file read, no fix will ship; replace with NSM

Exposure

Story timeline

  1. 2026-11-05CVE-2026-109593 and CVE-2026-109594, SonicWall GMS 9.5.2 and earlier: an unauthenticated network attacker may read internal GMS files (CVSS 3.1 9.1), and SonicWall says the end-of-life product gets no fix and has no workaround
    trending-vulnerabilitiesSonicWall GMS 9.5.2 and earlier: unauthenticated file read, no fix will ship; replace with NSM

Hunting pivots

Affected products
SonicWall GMS
Tags
info-disclosureno-patchpre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • CollectionData from Local System

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-05/sonicwall-gms-eol-unauthenticated-file-read-no-fix · ATT&CK page ↗

Collection TA0009

T1005Data from Local System×1

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-11-05/sonicwall-gms-eol-unauthenticated-file-read-no-fix · ATT&CK page ↗

Entries about SonicWall GMS 9.5.2 and earlier (end of life): post-authentication SQL injection, no fix (6.8) (1)

2026-11-05 · view entry permalink →

ROUTINECVE-2026-109593 +1NATOA2

CVE-2026-109593 and CVE-2026-109594, SonicWall GMS 9.5.2 and earlier: an unauthenticated network attacker may read internal GMS files (CVSS 3.1 9.1), and SonicWall says the end-of-life product gets no fix and has no workaround

SonicWall's advisory SNWLID-2026-0019 of 2026-11-03 covers the end-of-life Global Management System: an unauthenticated attacker with network access to GMS 9.5.2 and earlier may be able to read internal GMS files, potentially exposing sensitive information (CVE-2026-109593, CVSS 3.1 9.1), and a post-authentication SQL injection under specific conditions could let an authenticated attacker access or modify data (CVE-2026-109594, 6.8) (SonicWall, 2026-11-03). The advisory lists no workaround and no fixed version, says no remediation or security update will be released because the product has reached end of life, and strongly encourages migration to Network Security Manager (SonicWall, 2026-11-03). End of support was 2026-09-30 (SonicWall, 2025-05-05), and the previous GMS advisory of 2026-08-11 named 9.5.2 as the fixed build for its flaws, so the last fixed build is itself affected now (SonicWall, 2026-08-11). The advisory does not say which files are exposed or whether anyone exploits the flaw, and CERT-FR relays it (CERT-FR, 2026-11-04).

The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities.

An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.

SonicWall PSIRT (SNWLID-2026-0019) 2026-11-03
vulnerability05 Nov 03:59Zsingle-sourceOpen finding →
Sources: SonicWall PSIRT (SNWLID-2026-0019) · SonicWall (GMS end-of-life announcement) · SonicWall PSIRT (SNWLID-2026-0011) · CERT-FR (CERTFR-2026-AVI-1456)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • psirt.global.sonicwall.com2 (50%)
  • cert.cyber.gouv.fr1 (25%)
  • sonicwall.com1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)