SonicWall GMS: two flaws with no security patch to come
CERT-FR lists GMS 9.5.2 and earlier. The product is end of life and will receive no further security fixes: plan its retirement or replacement.
Going deeper
Generated image · SecuFocus
At a glance
Key points
Do you use SonicWall Global Management System to administer your equipment? CERT-FR reports two flaws in GMS 9.5.2 and earlier, with an important constraint: this end-of-life product will receive no further security fixes. Identify the affected instance and arrange its retirement or replacement rather than waiting for an update that will not be released.
The affected product is GMS, not every SonicWall appliance
CERTFR-2026-AVI-1456, dated 4 November, lists GMS 9.5.2 and earlier. The vendor data carried by NVD names Windows and Linux. This notice does not provide a firmware version to apply to every SonicWall firewall.
CERT-FR states that SonicWall will release no further security fixes for this end-of-life product. An installation already running 9.5.2 is therefore not considered fixed by this advisory.
The flaws require different levels of access
For CVE-2026-109593, NVD describes an unauthenticated attacker with network access to GMS who may be able to read internal files, potentially exposing sensitive information. CVE-2026-109594 is a post-authentication SQL injection: under specific conditions, an authenticated attacker could access or modify information in the GMS database.
These records describe possible attacks. They do not establish that your installation was compromised or that the two flaws have been exploited together.
Plan the transition without losing legitimate administration
Ask the network administrator whether a GMS instance is still in use, which version it runs and how it can be reached. Restrict access to the people and networks that need it while a replacement is prepared. Reducing exposure does not fix either flaw.
Before retirement, preserve the configuration and any evidence needed for an investigation, then check how the equipment will be administered afterwards. Do not switch off a production management console without arranging replacement access. If compromise is suspected, replacing the product alone will not establish what happened.
What was checked
This reading compares CERT-FR's notice with both NVD records, checked on 4 November. The SonicWall advisory linked by CERT-FR was not used as a direct source because its host is outside our authorised news-source list. We therefore provide neither a validated migration procedure nor a certified replacement product.
SecuFocus has not installed GMS or reproduced an attack. The access and continuity checks above are practical recommendations, not findings from an audit of your network.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.