SonicWall published an advisory on 3 November 2026 for its Global Management System covering two vulnerabilities, one of them unauthenticated. It also confirmed the part that matters more than the scores: GMS is end-of-life, so neither flaw will ever be patched.
What happened
The advisory, SNWLID-2026-0019, covers CVE-2026-109593, an unauthenticated file read rated 9.1, and CVE-2026-109594, a post-authentication SQL injection rated 6.8. Both affect GMS 9.5.2 and earlier on the virtual appliance and Windows builds.
The first flaw is a failure to fail securely: anyone who can reach the GMS interface over the network can read internal files, which on a management server means configuration and credential material. The second needs a valid login before it can touch the GMS database.
SonicWall's fix column says it plainly. A fix version is not available because the product has reached end-of-life. Customers are directed to Network Security Manager instead.
Who is affected
- Any organisation still running SonicWall GMS 9.5.2 or older, virtual or Windows, with the console reachable from anything other than a tightly restricted management segment.
- MSPs and IT teams that use GMS to manage firewalls across multiple customer sites, where the GMS server holds credentials and configuration for every managed appliance.
- Anyone who treated GMS as "still working, so leave it" after it went end-of-life. There is no future patch to wait for on this one.
What to do now
Treat this as a migration deadline rather than a patching task, and close network access to GMS today while you plan it.
- Inventory every GMS instance and confirm whether it is reachable from user networks, VPN pools or the internet.
- Restrict access to the GMS console and its services to a dedicated management VLAN and named admin hosts, and remove any NAT or firewall rule that publishes it.
- Assume file-read exposure if the console has been reachable: rotate credentials stored or managed through GMS, starting with firewall admin accounts and any SNMP or API secrets.
- Stand up SonicWall NSM and migrate management before you need the next firmware cycle, since GMS will not receive fixes for anything found after this.
What this means for South African businesses
GMS is the kind of product that survives in South African environments well past its end-of-life date, because it sits on a Windows server in the server room quietly managing a dozen branch firewalls and nobody wants to rebuild that on a Friday. That persistence is exactly the risk: an unpatched management console with a file-read flaw is a credential-harvesting target, and the credentials it holds are the ones that open every firewall you manage. My view is that the exposure here is not the individual CVE score but the fact that there is no remediation path at all, which turns a routine advisory into a project that needs a date.
Source: SonicWall PSIRT advisory SNWLID-2026-0019.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.