Critical unauthenticated file reading and authenticated SQL injection vulnerabilities affecting legacy SonicWall Global Management System deployments present significant operational risks, particularly because these end-of-life systems will receive no vendor patches. Organizations running version 9.5.2 and earlier face potential exposure to remote threat actors capable of extracting sensitive system data or manipulating underlying database records. Threat actors frequently target edge management infrastructure to compromise enterprise networks, making these unpatched flaws high-priority vectors for unauthorized access. Immediate exposure reduction requires migrating management operations to supported platforms while isolating legacy instances from untrusted networks.
CVE-2026-109593: This vulnerability involves an arbitrary file read flaw residing within legacy management components of the affected software. Unauthenticated remote attackers possessing network access can exploit this flaw to retrieve sensitive internal system files without credentials. Successful exploitation compromises internal data confidentiality and can expose sensitive configuration parameters. The absence of vendor patches for this end-of-life system leaves deployed instances permanently exposed to information disclosure.[/subscribe_to_unlock_form]
Critical unauthenticated file reading and authenticated SQL injection vulnerabilities affecting legacy SonicWall Global Management System deployments present significant operational risks, particularly because these end-of-life systems will receive no vendor patches. Organizations running version 9.5.2 and earlier face potential exposure to remote threat actors capable of extracting sensitive system data or manipulating underlying database records. Threat actors frequently target edge management infrastructure to compromise enterprise networks, making these unpatched flaws high-priority vectors for unauthorized access. Immediate exposure reduction requires migrating management operations to supported platforms while isolating legacy instances from untrusted networks.
CVE-2026-109593: This vulnerability involves an arbitrary file read flaw residing within legacy management components of the affected software. Unauthenticated remote attackers possessing network access can exploit this flaw to retrieve sensitive internal system files without credentials. Successful exploitation compromises internal data confidentiality and can expose sensitive configuration parameters. The absence of vendor patches for this end-of-life system leaves deployed instances permanently exposed to information disclosure.[emaillocker id="1283"]
CVE-2026-109594: This issue stems from a low-complexity SQL injection vulnerability affecting the core database interaction layers of the platform. Authenticated attackers with elevated privileges can interact with database parameters to access or modify restricted stored information. The flaw presents a high risk of database manipulation and privilege abuse within enterprise administration workflows. Because the product is discontinued, administrators cannot apply official software updates to remediate this vector.
Mitigating these exposures requires immediate migration from legacy management deployments to supported alternatives such as Network Security Manager. Administrators should restrict network-level access to vulnerable management interfaces using strict firewall segmentation and virtual private network restrictions until migration is complete. Continuous monitoring of edge network logs for unauthorized access attempts remains critical for detecting active compromise indicators.
We recommend you to refer this link: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019
The following reports contain further technical details:
[/emaillocker]