SonicWall GMS EOL: Unauthenticated File Read and High-Privilege SQL Injection Without Patches

1. Basic Information

• Article Title: CVE-2026-109593
• Publisher: SonicWall (CNA)
• Publication Date: 2026-11-03
• Collection Date: 2026-11-05T08:02:41+09:00
• Source: SonicWall CNA record
• Related Sources: End-Of-Life (EOL) SonicWall GMS Multiple Vulnerabilities, SNWLID-2026-0019
• Related Sources: BleepingComputer
• Related Sources: SonicWall CNA: CVE-2026-109594
• Related Malware: None specified
• Related Threat Groups: None specified
• CVEs: CVE-2026-109593, CVE-2026-109594
• Target Products/Services: SonicWall Global Management System 9.5.2 and earlier
• Severity: High
• Severity Basis: The centralized management system may expose internal files or database information. The reviewed public material does not establish active exploitation. With GMS already EOL and no patches planned according to the vendor guidance quoted by BleepingComputer, organizations should remove internet exposure and migrate.

2. Executive Summary

SonicWall GMS 9.5.2 and earlier are affected by unauthenticated internal file read (CVE-2026-109593) and post-authentication SQL injection (CVE-2026-109594), assessed as requiring high privileges by CISA ADP. GMS is EOL; the vendor guidance quoted by BleepingComputer says no patches will be provided and strongly recommends migration to Network Security Manager (NSM).

3. Attack Flow

The following describes vulnerability mechanics and potential outcomes, not a publicly observed attack sequence.

Unauthenticated File Read

1. An attacker reaches the GMS management interface from an internal network or, if exposed, the internet.
2. CVE-2026-109593 may allow internal files to be read without authentication.
3. Inference: Retrieved information could support later access to managed appliances; such follow-on compromise has not been confirmed.

Post-Authentication SQL Injection

1. An attacker with the required authenticated GMS privileges submits crafted input.
2. CVE-2026-109594 can affect backend database queries under specific conditions.
3. The attacker may access or modify GMS database information. The exact affected account role and record scope are not disclosed.

4. Attacker Positioning and Execution Location

• CVE-2026-109593 requires network reachability to GMS as an unauthenticated user, while CVE-2026-109594 requires a high-privileged GMS user account.

5. Visibility for Victims and Administrators

Victims

• May appear as indirect impacts on managed networks.

Administrators

• Potential investigation leads include GMS web requests, internal-file requests, abnormal SQL queries, and configuration or device-management activity. These are not published attack observations.

6. Success and Failure Conditions

Success Conditions

• GMS 9.5.2 or earlier is running and its management interface is reachable by the attacker.
• CVE-2026-109594 additionally requires authenticated high-privilege access, according to CISA ADP's assessment.

Failure Conditions and Mitigations

7. What Happens Upon Success

• Reading of internal files and sensitive information.
• Access to and modification of GMS database information.
• Inference: Subsequent access to managed devices using the retrieved information.

8. Observable Logs

Inference: The following are investigation and detection suggestions for an organization, not incident observations reported by the source. Use them where access, logging, and audit settings permit.

• Email: No email vectors have been published for this issue.
• Proxy / SWG / DNS: Suspicious paths, parameters, and large file requests directed at the GMS interface.
• Endpoint / EDR: File access, web processes, and database processes on the GMS server.
• Identity / IdP: Logins and query executions by high-privileged GMS accounts.
• SaaS / Cloud: NSM/GMS management audits and device configuration changes.
• Network: External access to GMS and subsequent communications to managed appliances.

9. Attack Success Determination

The following is an assessment criterion for an organization's investigation, not a published observation of attacks.

• Attack Attempts Observed (Success Unconfirmed) — conditional classification: The reviewed public material does not report active exploitation or observed attempts. If suspicious requests are found locally, do not classify them as successful file reads or database compromise without evidence from responses or database operations. (Scope: Local assessment of GMS 9.5.2 and earlier.)

Distinguish request arrival, execution, authentication, information exposure, and follow-on compromise.

10. Investigation Playbook

Inference: The following are investigation and detection suggestions for an organization, not incident observations reported by the source. Use them where access, logging, and audit settings permit.

Trigger

• Suspicious file requests to GMS, SQL errors, or abnormal operations by high-privileged accounts.

Initial Checks

• Check version, EOL status, exposure, accounts, and managed devices.

Endpoints

• Preserve GMS web and database logs, file access records, and configurations.

Authentication and Cloud

• Audit high-privileged accounts, sessions, and credential usage.

Subsequent Operations

• Track logins to managed SonicWall devices, configuration changes, and credential reuse.

Containment

• Block external access, migrate to NSM, rotate credentials, and isolate affected systems.

Classification

• Distinguish between requests, file reads, SQL access, configuration changes, and device compromise.

11. Defense and Detection Ideas

Inference: The following are investigation and detection suggestions for an organization, not incident observations reported by the source. Use them where access, logging, and audit settings permit.

Single Events

• Detect internal file responses, SQL errors, and abnormal administrative queries from GMS.

Timeline Correlation

• Correlate external requests, file reads, credential use, and device management operations.

Threat Hunting

• Search for GMS versions 9.5.2 and earlier, internet exposure, and high-privileged account histories.

Log Gaps

• If audit logs are insufficient on EOL systems, supplement them with reverse proxy or network device logs.

Priority Controls

• Prioritize GMS isolation, NSM migration, credential rotation, and the principle of least privilege.

12. Facts / Inference / Hypothesis

Facts

• The SonicWall CNA describes CVE-2026-109593 as allowing an unauthenticated attacker with network access to read internal GMS files, potentially exposing sensitive information.
• For CVE-2026-109594, the CNA describes post-authentication SQL injection that may permit access to or modification of GMS database information under specific conditions. CISA ADP assesses high privileges and low attack complexity.
• The CNA records identify GMS 9.5.2 and earlier and mark the product unsupported when assigned. BleepingComputer quotes vendor guidance that no patches will be provided.
• The vendor guidance quoted by BleepingComputer strongly recommends migration to Network Security Manager.
• The reviewed advisories and reporting do not establish active exploitation.
• Both CNA records reference SNWLID-2026-0019; they do not split these two CVEs between SNWLID-2026-0019 and SNWLID-2026-0020.

Inference

• If configuration or credential material such as password hashes is exposed through file read, it could enable subsequent access to managed security appliances. That is a potential follow-on consequence, not a confirmed campaign outcome.

Hypothesis

No additional hypotheses. Unconfirmed matters are listed under Open Questions and Further Research.

13. MITRE ATT&CK Mapping

14. Open Questions and Further Research

• The full scope of readable files, public PoCs, active exploitation status, and the number of internet-exposed instances remain unknown.

15. Impact on SOCs and Organizations

GMS centrally manages important perimeter security appliances. Leaving an unpatched EOL management platform in operation creates a concentration of risk that could affect defenses across the organization. Organizations running GMS should remove internet exposure, isolate management access to a trusted segment, and prioritize migration to a supported platform such as NSM.

16. Summary by Role

• SOC: Correlate unauthenticated requests to GMS, file reads, SQL queries, and subsequent access to managed devices.
• Administrators: Isolate GMS from the internet, migrate to NSM, and audit administrative credentials and access logs.
• Users: Follow guidance on service impacts during the platform migration managed by administrators.