Plan ahead Critical Check your exposure CVSS 9.1
SonicWall will not patch two flaws in end-of-life management software
The Hacker NewsSonicWallCVE-2026-109593
What happened. SonicWall warned of two flaws in its end-of-life Global Management System (GMS) and said it will not patch them. One, CVE-2026-109593 (CVSS 9.1), lets an unauthenticated attacker with network access read internal GMS files.
Who is affected. Users of SonicWall GMS 9.5.2 and earlier. Industrial sites that manage perimeter firewalls through it are exposed, because engineers and vendors often reach plant systems through those devices.
What to do. Check whether you run SonicWall GMS 9.5.2 or earlier. Plan to replace it, as no patch is coming, and restrict who can reach it meanwhile.
When to act. Plan ahead: CVSS 9.1
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L4
- L3.5
Why: GMS manages SonicWall perimeter devices, so it sits in the industrial DMZ (L3.5) or enterprise network (L4) and is a route towards plant systems.
- Are you exposed?
Search the asset inventory for SonicWall GMS 9.5.2 or earlier and check whether its management interface is reachable from untrusted networks.
- If you cannot fix it yet
- Limit network access to the GMS console to named administrator hosts only.
- Keep GMS off the plant network and out of reach of the internet.
- Retire the end-of-life software and move to a supported management product.
- Watch for
- Unauthenticated requests to GMS web services from unexpected hosts, especially those that read internal files.
- Unexpected changes to GMS database records or to the settings of firewalls it manages.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: The Hacker News (opens thehackernews.com)
More on SonicWall CVE-2026-109593