SonicWall GMS has a critical file-read bug that will never be patched. If you still run GMS, take it off the network

SonicWall has disclosed two vulnerabilities in its Global Management System (GMS), the on-premises console many organizations used to manage fleets of SonicWall firewalls. The more serious one, CVE-2026-109593, lets an unauthenticated attacker with network access read internal GMS files. It is rated CVSS 9.1 (critical). SonicWall published the notice, SNWLID-2026-0019, on November 3, and both CVE records went public the same day.

Why it matters: there will be no patch. GMS reached end of support on September 30, 2026, and according to Daily CyberSecurity's summary of the notice, SonicWall said no remediation or security update will be released for these bugs. A management console can hold firewall configurations and credentials for the devices it controls, so a file-read bug there is serious.

What's affected

Daily CyberSecurity says both the Virtual Appliance and Windows builds of GMS are affected.

Is it being exploited? Not yet, as far as anyone has reported. Daily CyberSecurity says SonicWall knows of no attacks on customer networks and that no public exploit code exists. OffSeq's tracker, as of November 3, found no Metasploit or Exploit-DB module, no scanner template, no CISA KEV listing and no observed attack traffic. That could change quickly, because the bug requires no login. Some exploit-aggregator sites already list entries titled as a "PoC" for this CVE. The one we checked contained only the advisory text, with no code.

What to do

1. Find out if you still run GMS. Look for GMS virtual appliances or Windows servers running GMS 9.5.2 or earlier. Check older branch offices and any MSP-managed environments too.
2. Take it off the network, or at least off the internet. SonicWall's guidance, as reported, is to take end-of-life GMS hosts offline. If you can't do that right away, block access to the GMS web ports from everywhere except a small, trusted admin subnet. Never expose GMS to the internet.
3. Assume anything it stored may be exposed. If a GMS server has been reachable from untrusted networks, rotate the credentials it held for managed firewalls and for its own admin accounts. Review the firewall configurations it pushed.
4. Migrate to Network Security Manager (NSM). SonicWall's end-of-life notice names NSM 3.0 as the replacement, offered as SaaS or on-premises, and says the SaaS version has feature parity with GMS. GMS sales ended on October 1, 2025.

The bigger lesson

End-of-life dates sound like paperwork until a bug like this shows up. GMS went out of support only five weeks ago, and it already has a critical vulnerability that will stay open for good. If you have other management consoles, VPN concentrators or backup appliances near their end-of-support date, now is a good time to check the list.