Nice2GeekYou

Your SonicWall Management Console Just Went Unpatched Forever — Get It Off the Internet

SonicWall confirmed two flaws in end-of-life GMS — including a critical unauthenticated file read — and said no patch is coming. If that console still manages your firewalls, treat it like a vault of keys left unlocked.

  • sonicwall
  • firewall
  • gms
  • network-security
  • smb
  • msp
  • cybersecurity
  • texas-it
  • managed-it

If SonicWall Global Management System (GMS) still runs your firewall fleet, there is no security update coming — ever. This week SonicWall warned that GMS 9.5.2 and earlier are hit by a critical unauthenticated file-read flaw (CVE-2026-109593, CVSS 9.1) and a post-auth SQL injection (CVE-2026-109594). GMS reached end of support on September 30, 2026, so SonicWall will not ship fixes. The vendor’s answer is migrate to Network Security Manager (NSM).

Why it matters for your money

GMS is the box that deploys policy, pulls logs, and holds credentials for every SonicWall appliance it manages. An attacker who can read internal files on that console may get configurations and secrets that open the rest of the perimeter. That is not a “patch next maintenance window” problem — it is a standing exposure on every GMS install that stays online.

BleepingComputer and MSP Business both covered SonicWall advisory SNWLID-2026-0019 this week. Active exploitation was not reported as of early November, but CISA has already catalogued many SonicWall flaws as actively exploited in recent years. Leaving an EOL management console reachable from the internet is how a quiet file read turns into a weekend of downtime, ransomware recovery, and lost sales.

What to do this week

  1. Confirm whether you still run GMS (virtual appliance or Windows), including any MSP-hosted copy that manages your firewalls.
  2. Take GMS off the public internet immediately. Put it on a management VLAN or VPN-only path with a tight allow list. Do not wait for a cutover date.
  3. Rotate credentials and keys that lived in or were used by GMS — firewall admin passwords, API keys, shared secrets — especially if the console was reachable from outside.
  4. Schedule the migration to NSM (or another supported manager) with a named owner and a hard date. SonicWall’s only endorsed fix is leaving GMS.
  5. Watch firewall and GMS logs for odd admin logins, config pulls, or new management sessions after any exposure.

For South Texas teams on-site: walk the rack, find the GMS host, and confirm it is not port-forwarded or sitting on a public IP. For remote-managed clients nationwide: ask your MSP in writing whether any SonicWall firewalls are still managed from GMS and when NSM cutover happens.

Nice2GeekYou is based in San Antonio and serves all of Texas on site, and our managed IT plans cover remote clients across the U.S. We help SMBs inventory firewall management tools, lock down exposed consoles, and plan a clean cutover so an EOL product does not become next quarter’s incident. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: BleepingComputer — SonicWall warns of unpatched flaws in end-of-life GMS software; MSP Business — Patchwork Thursday 5 November 2026 (citing SonicWall advisory SNWLID-2026-0019 / CVE-2026-109593).