Unauthenticated File Read (CVE‑2026‑109593) & Database Alteration Flaws in SonicWall Global Management System (GMS) Remain Unpatched
What It Is — SonicWall disclosed two critical vulnerabilities in its Global Management System (GMS) 9.5.2 and earlier, both of which are end‑of‑life and will not receive patches.
- CVE‑2026‑109593 (CVSS 9.1) is an unauthenticated file‑read flaw that lets any network‑connected attacker enumerate internal GMS files.
- A second, unnamed vulnerability permits unauthenticated alteration of database records, potentially corrupting configuration data.
Both issues require only network access to the GMS console; no credentials are needed. SonicWall’s decision not to patch leaves the flaws exploitable in the wild, and no official mitigations have been published.
Affected Products — SonicWall Global Management System (GMS) 9.5.2 and earlier (end‑of‑life).
Why It Matters for Trust & Control Assurance — The situation tests the vendor‑oversight and patch‑management control objective: organizations must verify that third‑party products are either fully supported or mitigated, and retain evidence of that verification.
Recommended Actions —
- Inventory all SonicWall GMS instances and confirm version.
- Isolate or decommission any GMS that cannot be upgraded.
- Apply network‑segmentation or firewall rules to restrict access to the GMS console.
- Document the risk decision (accept, mitigate, retire) and retain evidence for audit.
Source: The Hacker News