SonicWall, the CVE numbering authority for both records, published CVE-2026-109593 and CVE-2026-109594 on 3 November 2026 (UTC; 4 November Perth) against Global Management System (GMS) 9.5.2 and earlier on Windows and Linux, citing its advisory SNWLID-2026-0019.

According to the CVE-2026-109593 record, an unauthenticated attacker with network access to GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.

According to the CVE-2026-109594 record, a post-authentication SQL injection in the end-of-life GMS 9.5.2 and earlier could, in specific conditions, let an authenticated attacker access or modify information stored in the GMS database. Both records are tagged unsupported-when-assigned and credit researchers from Pentest-Tools.com. CISA's enrichment on the records scores CVE-2026-109593 at CVSS 3.1 9.1 and CVE-2026-109594 at 6.8, and records exploitation as none as of 3 November.

BleepingComputer (4 Nov) quotes SonicWall: "The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities," and SonicWall strongly encourages organisations using GMS to upgrade to SonicWall Network Security Manager (NSM). (sources: CVE-2026-109593 and CVE-2026-109594 records; BleepingComputer)