According to Security NEXT, SonicWall disclosed two vulnerabilities in Global Management System (GMS) on November 3, 2026, but will not provide patches because the product has reached end of support [1]. CVE-2026-109593 allows unauthenticated attackers to read internal files over the network and carries a CVSS v3 score of 9.1 [1]. CVE-2026-109594 is an authenticated SQL injection vulnerability requiring specific conditions to read or write database contents, rated 6.8, and the company urges customers to migrate to alternative products [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
End-of-Life SonicWall GMS Discloses Two Unpatched Vulnerabilities; Vendor Urges Migration
1 min read
- Disclosed
- Nov 4, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- [1]
- 0.5%, higher than 45% of CVEs
- Attack vector
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Technology
What to do nowOur advice
CVE-2026-109594 is an authenticated SQL injection vulnerability requiring specific conditions to read or write database contents, rated 6.8, and the company urges customers to migrate to alternative products [1]
Timeline
- Security NEXT publishes report (date only; timestamp is a placeholder)[1]
Technical details
Source-Verified Summary
SonicWall disclosed two vulnerabilities in Global Management System (GMS) on November 3, 2026, but will not provide patches because the product has reached end of support. [1]
CVE-2026-109593 allows unauthenticated attackers to read internal files over the network and carries a v3 score of 9.1. [1]
CVE-2026-109594 is an authenticated SQL injection vulnerability requiring specific conditions to read or write database contents, rated 6.8, and the company urges customers to migrate to alternative products. [1]
References
Media1
- [1]
“SonicWallの管理製品「SonicWall Global Management System（GMS）」に深刻な脆弱性が明らかとなった。すでにサポートが終了しており修正版の提供は行わないとして、別製品への移行を求めている。”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.