SonicWall GMS file-read flaw will get no patch, says Italy's ACN

SonicWall GMS file-read flaw will get no patch, says Italy's ACN

5 November 2026: SonicWall Global Management System 9.5.2 and earlier has a critical flaw, CVE-2026-109593, that lets an attacker who is not logged in read internal files such as configurations and management data. There will be no fix, according to Italy's national cybersecurity agency ACN, because the product is past its end of support. ACN's bulletin does not report exploitation.

Not yet independently verified. SonicWall's advisory SNWLID-2026-0019 would not render for us, so this rests on ACN's bulletin; we have not read the vendor's own wording, its CVSS score or the second CVE number. ACN does not report exploitation. We will update this when it can be confirmed, and remove this note.

What is affected

ACN's bulletin covers two new vulnerabilities, one of them critical, under SonicWall's reference SNWLID-2026-0019. Both forms of the product are in scope:

• GMS Virtual Appliance, version 9.5.2 and earlier;
• GMS on Windows, version 9.5.2 and earlier.

GMS is the console from which an organisation or a managed service provider runs its SonicWall firewalls, and that is what makes a file read serious here. The bulletin mentions configuration and management data, and in a console like this such files can describe the whole managed estate, so anything a reader takes from them may help in an attack on the firewalls themselves.

An end-of-support product with one way out

ACN says the vendor will not release a patch and advises planning a migration to SonicWall's Network Security Manager. That turns the job from a change window into a project, because moving firewalls to a different manager involves reporting, templates and staff access as well as the software itself.

A team that cannot move this week can still reduce what is exposed. The console should not be reachable from the internet, and access should be limited to a management network or VPN. These are general precautions rather than a fix, and they do not remove the flaw from anyone already inside the network.

An organisation that does not know whether it runs GMS should ask its managed service provider, since a provider's console is often where a customer's firewall configuration ends up. Any credentials or shared secrets stored in a GMS configuration that has been exposed should be considered for rotation once it is replaced.

Why this has taken a while to reach buyers

Reports of end-of-life flaws in GMS surfaced in the security press earlier this week, but SonicWall's own advisory page has not rendered for us, and ACN is the first official source we have been able to read. A product with no patch coming will not appear in anyone's patch queue, so this is easy to miss unless someone is checking for GMS by name.

We list SonicWall among 326 cybersecurity companies, and a firm replacing GMS has reason to compare the alternatives before committing to the vendor's own manager, particularly if the firewalls themselves are close to renewal.

Related on TrustList:

• Cisco Meraki hardening release covers seven flaw classes, top score 9.6
• FBI warns FortiBleed is still hitting exposed FortiGate VPNs
• ModSecurity web application firewall: bypass and crash flaws fixed in 3.0.17 and 2.9.15, one filename bypass still unpatched

Sources

• ACN (Italy's national cybersecurity agency): vulnerabilities in SonicWall products, 5 November 2026, 5 November 2026
• SonicWall PSIRT advisory SNWLID-2026-0019 (page did not render when read on 6 November 2026), 6 November 2026