SonicWall said in an advisory that two flaws affect its Global Management System (GMS), version 9.5.2 and earlier. The product has reached end of life. SonicWall says no fix will come and strongly encourages customers to upgrade to Network Security Manager. CVE-2026-109593 lets an attacker with network access read internal GMS files without logging in. It scores 9.1 out of 10. CVE-2026-109594 is an SQL injection, a way to slip database commands into input. It needs a logged-in attacker and scores 6.8.
SonicWall labels the file flaw as failing open, meaning a check that allows access when it breaks. The SQL flaw needs a login, so only someone with an account can use it. SonicWall says it could let that person read or change database data, only in specific conditions it does not describe. Neither source says anyone is attacking these flaws, which files could be exposed, or how many customers run GMS.
This is interpretation, not source fact: a management console that cannot be patched is an exposed control point. Teams could list every GMS instance, limit who can reach it, ask what it holds and controls, and plan the move to NSM. For these two flaws, end of life means no fix will come.