Security · November 6, 2026
Also published in Français, Türkçe, Deutsch, Italiano, Русский, Español, Nederlands, Norsk, Polski, Português (Brasil), Svenska
Critical vulnerability discovered in SonicWall GMS
A critical vulnerability has been revealed in SonicWall's management product, SonicWall Global Management System (GMS). Support for the product has already ended, and the company has stated that no patches will be provided, urging users to transition to alternative products.
The software is designed for centralized management of multiple security devices, including firewalls manufactured by the company. On November 3, 2026, local time, the company published a security advisory detailing two vulnerabilities: CVE-2026-109593 and CVE-2026-109594.
CVE-2026-109593 allows unauthorized reading of internal device files over the network, posing a risk of leaking sensitive information externally.
On the other hand, CVE-2026-109594 is an SQL injection vulnerability. While authentication is required for exploitation, it can enable viewing or tampering with information stored in the database under specific conditions.
The company has assessed the base scores according to the Common Vulnerability Scoring System (CVSSv3.1), rating CVE-2026-109593 with a score of 9.1 and CVE-2026-109594 with a score of 6.8.