SonicWall advisory SNWLID-2026-0019 published November 3, 2026; coverage November 4 to 7, 2026
No Patch Is Coming: Two SonicWall GMS Flaws, One Rated 9.1, End With the Product Itself
Most advisories end with a patch instruction. SonicWall advisory SNWLID-2026-0019, published November 3, ends with a retirement instruction. It discloses two flaws in Global Management System (GMS) 9.5.2 and earlier and states in plain terms that the affected product has reached end of life, so no remediation or security update will be released, and customers should move to Network Security Manager (NSM). The serious flaw is CVE-2026-109593, an unauthenticated internal file read classed as CWE-636 and scored 9.1 in the CISA ADP container of the record: an attacker with only network access may read internal GMS files and expose sensitive information, which in a tool built to manage many firewalls centrally can mean configurations and credentials. The second, CVE-2026-109594, is a post-authentication SQL injection scored 6.8 that under specific conditions could let a logged-in attacker access or modify information in the GMS database. Neither flaw had reported exploitation when published, CISA SSVC assessment lists exploitation as none, and neither was in the Known Exploited Vulnerabilities catalog as of the November 3 update, so this is a documented exposure decision, not an incident in progress. The contrast inside SonicWall own recent record sharpens it: the SMA1000 flaw CVE-2026-102255, scored 10.0, did receive a fix and has since drawn thousands of recorded exploitation attempts, while GMS will stay exactly as vulnerable as it is today for as long as it stays switched on. Until a migration finishes, the only controls are isolation: no internet reachability, access limited to a small set of management hosts, unneeded accounts removed, and logs watched for unusual file access or database errors, with the honest caveat that none of that removes the flaws.
Executives
An unpatchable flaw in a management console is a capital decision wearing a security label: the product will not get safer, the finding is now public and citable by auditors and insurers, and every week of delay is exposure chosen rather than inherited. Ask for the migration date to NSM or an equivalent, the inventory of every GMS instance including test and forgotten servers, and the isolation evidence for the interval between now and that date. If no date exists, that is the finding to act on.
CIO / CISO
Record this in the risk register as an accepted exposure with an end date, not as a pending patch, because no patch queue will ever clear it. Sequence the work: discover every GMS instance, cut internet reachability the same day, restrict access to named management hosts or a separate management network, prune accounts since the SQL injection needs a login, and set a migration milestone to NSM with the GMS shutdown as the closure criterion. Keep the exploitation status precise in reporting, none reported and not in the KEV catalog as of November 3, while noting that public detail plus no fix is the combination that shortens windows.
Engineers
Treat any GMS server as hostile-adjacent until it is off. Confirm no GMS interface answers from the internet, move management access behind your jump path, and baseline the file access and database error patterns you would hunt for, since a file read leaves quieter evidence than a crash. Preserve the configuration and account inventory before migration so the NSM build does not inherit stale firewall objects or dormant accounts. After shutdown, keep the decommission record: a powered-off GMS that can be powered back on during an incident is still an exposure.
Everyone (non-IT)
Nothing in this story asks anything of ordinary firewall users. The version worth remembering is that software has an end of life the way appliances do, except that an unsupported management tool does not just stop receiving features; it keeps every flaw it will ever have, in public, for anyone to read. If a tool at work announces it is being retired, that notice is a security instruction, not an administrative one.