CVE-2026-109593: SonicWall GMS Exposed Without Authentication

CVE-2026-109593 affects SonicWall Global Management System (GMS), the centralized management solution for SonicWall appliances used in critical enterprise infrastructure. An unauthenticated attacker with network access can directly read internal GMS files in version 9.5.2 and earlier, accessing potentially sensitive information without requiring credentials.

The flaw has a CVSS score of 9.1 and is classified as critical. The high score reflects both the intrinsic severity (reading of critical files) and the low effort required by the attacker: only network access is needed, with no authentication required. The vulnerability was disclosed on November 2, 2026. According to monitored signals, 4 posts were recorded in the last 24 hours with 13 total interactions, indicating moderate but growing awareness of the issue.

System administrators and CISOs managing SonicWall infrastructure must immediately verify which GMS versions are in use. It is essential to continuously monitor official SonicWall channels for security patch releases. In the meantime, it is advisable to severely restrict network access to GMS to only trusted corporate hosts and networks using perimeter firewalls or network segmentation. No public exploits have been confirmed yet, but time is critical given the absence of an authentication barrier.