SonicWall will not patch two flaws in its end of life GMS

SonicWall has warned that two vulnerabilities affecting its End-of-Life Global Management System (GMS) will not be patched. The flaws affect GMS 9.5.2 and earlier, and SonicWall states that there will be no remediation or security updates because the product is past its support life.

The bugs are CVE-2026-109593, an unauthenticated file-read vulnerability with a CVSS score of 9.1, which could allow an attacker with network access to read internal GMS files and potentially expose sensitive information, and CVE-2026-109594, a post-authentication SQL injection flaw rated 6.8, which could enable an authenticated attacker to read or modify data in the GMS database under certain conditions.

SonicWall’s advisory (vuln-detail SNWLID-2026-0019) urges users to upgrade to SonicWall Network Security Manager (NSM) due to the lack of patches for affected EoL systems. The disclosure follows fixes shipped less than a month earlier for CVE-2026-102255, a critical pre-authenticated SSRF flaw, which was reported as actively exploited in the wild.

Previdian telemetry tracked thousands of exploitation attempts from eight IP addresses since 9 October 2026, underscoring a broader pattern of pressure on SonicWall deployments as older products reach end-of-life. The Hacker News, reporting on 4 November 2026, attributes these details to SonicWall and notes the upgrade recommendation as the practical response for affected organisations.