unpatched/intel
Latest briefing
Patch nowcriticalExploited Vulnerabilities

SonicWall Global Management System flaws expose files and database records via CVE-2026-109593

By Harith Dilshan1 min read

TL;DR

SonicWall has confirmed that two vulnerabilities in its end-of-life Global Management System (GMS) will not be patched. This affects users of GMS 9.5.2 and earlier. You must migrate to the SonicWall Network Security Manager (NSM) to secure your environment.

What happened

SonicWall issued an alert regarding two security flaws affecting its legacy Global Management System (GMS). The first, CVE-2026-109593, is a critical unauthenticated file read vulnerability with a CVSS score of 9.1. An attacker with network access could read internal GMS files and potentially access sensitive information.

The second flaw, CVE-2026-109594, is a post-authentication SQL injection vulnerability with a CVSS score of 6.8. This could allow an authenticated attacker to access or modify data within the GMS database under specific conditions. Because the GMS product has reached end-of-life status, SonicWall will not release any security updates or remediations for these issues.

Why it matters

Running end-of-life software creates a permanent window of opportunity for attackers. While the SQL injection requires authentication, the CVE-2026-109593 file read flaw is unauthenticated and carries a critical severity rating. This means anyone with network access to the system could potentially scrape sensitive configuration or system files. This news follows recent active exploitation of a different, previously patched SSRF flaw in SonicWall products, signaling that legacy or unpatched infrastructure remains a high-priority target.

Who is affected

  • SonicWall Global Management System (GMS) versions 9.5.2 and earlier

What to do now

  1. Upgrade to the SonicWall Network Security Manager (NSM) immediately.
  2. Decommission any remaining end-of-life GMS instances that cannot be migrated to NSM.

What we don't know yet

  • Whether these specific GMS vulnerabilities are currently being exploited in the wild.
  • The full extent of the potential impact on database integrity via the SQL injection flaw.

Sources

  1. thehackernews.comhttps://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html
  2. psirt.global.sonicwall.comhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

Offensive security engineer, ethical hacker and penetration tester. Writes Unpatched Intel from h4rithd.com.

Patch nowExploitedhighExploited VulnerabilitiesNew

Attackers exploit critical SQL injection vulnerability to gain full administrative access to Metabase

A critical zero-day SQL injection vulnerability in Metabase has been exploited in the wild. Attackers can gain full administrative access to the application database, allowing them to steal credentials and export data from connected databases. Self-hosted users must upgrade immediately; Metabase Cloud instances have already been patched.

2 min
Patch nowExploitedcriticalExploited VulnerabilitiesNew

Unauthenticated attackers exploit WP2Shell vulnerabilities to achieve remote code execution on WordPress websites

Attackers are actively exploiting two critical vulnerabilities, dubbed "WP2Shell," to take control of WordPress websites. The flaws allow unauthenticated users to execute code remotely on stock installations without any plugins or special permissions. Update your WordPress core immediately to version 7.0.2 or the relevant backport for your branch.

CVE-2026-60137CVE-2026-630303 min
Patch nowExploitedhighExploited VulnerabilitiesNew

Attackers exploit SonicWall SMA zero-day vulnerabilities to gain unauthorized root access

🚨 Attackers are actively exploiting zero-day vulnerabilities within SonicWall Secure Mobile Access (SMA) appliances. If you manage these devices, prioritize checking for unauthorized access or unexpected configuration changes immediately. Patching and monitoring your edge perimeter is the first line of defense against this activity.

2 min