SonicWall Won't Patch Two Flaws in End-of-Life GMS
SonicWall says GMS 9.5.2 and earlier has an unauthenticated file read and a SQL injection flaw, and that no fix is coming. Owners are told to move to NSM.
Dave "Kilobaud" FerrisSonicWall has told customers that two vulnerabilities in its Global Management System (GMS) will never be patched, because the product has reached end of life. The affected versions are GMS 9.5.2 and earlier, according to The Hacker News, which cites a SonicWall alert issued on Tuesday, November 3.
What was disclosed
- CVE-2026-109593 (CVSS 9.1): an unauthenticated file read. An attacker with network access could read internal GMS files, potentially exposing sensitive information.
- CVE-2026-109594 (CVSS 6.8): a post-authentication SQL injection. An authenticated attacker could access or modify data in the GMS database under specific conditions.
SonicWall’s stated position, as quoted by The Hacker News: “no remediation or security update will be released for these vulnerabilities.” The company strongly encourages organizations to upgrade to SonicWall Network Security Manager (NSM). The source does not mention a workaround, and neither do we claim one exists.
What to do
If you still run GMS 9.5.2 or earlier, the only vendor-endorsed path is migration to NSM. Until then, the sensible interim step is to limit who can reach the management interface at all, since the more severe flaw needs only network access and no login. That is general hardening, not guidance from SonicWall.
The reporting does not say either flaw is under attack. It does say a different SonicWall bug is: CVE-2026-102255, a critical pre-authentication server-side request forgery flaw patched less than a month ago, has since been exploited, with Previdian telemetry recording 2,541 attempts from eight IP addresses since October 9 and as many as 30 on November 3. We covered that one in SonicWall SMA1000 Max-Severity Flaw Exploited.
Analysis
End-of-life notices are quiet by design, and this one is a familiar kind: the vendor discloses a serious bug, then says the product is past the point where it gets fixed. We covered an earlier round of GMS fixes in SonicWall GMS Patched for Critical Unauth RCE Flaws, so anyone who kept GMS around after that had a signal. Management consoles hold configuration and credentials for whatever they manage, which is why an unpatchable one tends to outlast its welcome and then become somebody else’s incident. That is opinion, not reporting.
More in the SonicWall topic hub.
Found this useful? Share it.
