SonicWallAnalysisSonicWall discloses critical unpatched file read flaw in End-of-Life Global Management System
What happened.SonicWall published security advisory SNWLID-2026-0019 detailing critical vulnerabilities in the Global Management System platform, warning that no patches will be released.
Why it matters.Management platforms coordinate firewall policies and authentication across distributed branch networks. When perimeter management software harbors unauthenticated file read defects after product retirement, automated scans weaponize exposed consoles to harvest network topology and credentials. Security operations teams managing legacy hardware must disconnect vulnerable management servers from public networks immediately. Platform engineers should migrate active firewall policies to supported alternatives.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-109593 with a CVSS score of 9.1, an unauthenticated file read defect allows remote network attackers to extract internal system files.
- Secondary database flaw: Tracked as CVE-2026-109594 with a CVSS score of 6.8, an authenticated SQL injection weakness permits high-privilege actors to alter backend database tables.
- Affected deployments: The defects impact SonicWall Global Management System version 9.5.2 and earlier across virtual appliance and Windows server installations.
- Lifecycle status: Because the product reached its End-of-Life milestone in September 2026, SonicWall will not issue patches, directing organizations to migrate to Network Security Manager.