SonicWall Will Not Patch Two Flaws in End-of-Life GMS

SonicWall has disclosed two security vulnerabilities in its end-of-life Global Management System (GMS) that will not receive patches. The issues affect SonicWall GMS 9.5.2 and earlier versions: CVE-2026-109593, an unauthenticated file-read flaw rated 9.1 out of 10, and CVE-2026-109594, a post-authentication SQL injection vulnerability rated 6.8.

The company said no remediation or security update will be released because the affected GMS product has reached end of life. SonicWall is strongly encouraging organizations still using it to upgrade to SonicWall Network Security Manager (NSM).

What the two GMS vulnerabilities allow

CVE-2026-109593 could allow an attacker with network access to read internal GMS files without authentication. SonicWall said this may expose sensitive information held in those files. Its CVSS score of 9.1 places it among the more severe issues in the affected product line.

CVE-2026-109594 requires authentication, but could enable an attacker to access or modify information stored in the GMS database under specific conditions. SQL injection flaws are significant in management platforms because database records can contain operational data central to the system’s administration.

The disclosure adds to recent security pressure on SonicWall environments. In the context set by SonicWall attacks and SaaS security risks, SonicWall has remained part of a broader stream of attacks and vulnerability disclosures affecting enterprise infrastructure.

No fix means the upgrade decision is operational

SonicWall’s position is unambiguous: GMS has reached end of life, so customers cannot expect a vendor security update for either CVE. The recommended replacement is NSM, SonicWall’s Network Security Manager.

Less than a month before this advisory, SonicWall issued fixes for CVE-2026-102255, a critical pre-authentication server-side request forgery vulnerability with a CVSS score of 10.0. The flaw could allow an attacker to reach internal functionality and perform unauthorized operations. Previdian telemetry recorded 2,541 attack attempts from eight unique IP addresses in Singapore and the United States from October 9, 2026, including as many as 30 attempts on November 3.

Business implication

Organizations should establish whether GMS 9.5.2 or an earlier release remains in use, assess its network accessibility, and treat migration to NSM as a risk-management priority because these two disclosed vulnerabilities have no planned patch.