Science & Tech · Cybersecurity · 3 hrs ago
SonicWall Will Not Patch Two Flaws in End-of-Life GMS Software
SonicWall has warned of two security flaws in its Global Management System, or GMS, software.
The flaws affect GMS 9.5.2 and earlier, versions that have reached end of life.
GMS lets IT administrators manage many SonicWall security appliances from one interface.
One flaw could let an attacker with network access read internal files without signing in, while the other could let an authenticated attacker access or change database information under certain conditions.
SonicWall will not release security updates for the flaws because the product is no longer supported.
The company urges users to upgrade to Network Security Manager, its replacement platform, to address the risk.
SonicWall says it will not patch two security flaws affecting its end-of-life Global Management System (GMS).
The flaws affect GMS 9.5.2 and earlier versions and could expose internal files or allow database information to be accessed or modified.
SonicWall urges organizations using the software to upgrade to its Network Security Manager platform.
The vulnerabilities were found and reported by Pentest-Tools security researchers.
- Who
- SonicWall and organizations using its Global Management System (GMS).
- What
- SonicWall warned of two vulnerabilities and said it will not release patches because GMS has reached end of life.
- When
- SonicWall issued its alert on Tuesday, November 3, 2026.
- Where
- GMS 9.5.2 and earlier versions; the affected systems’ locations are not stated.
- Why
- The product has reached end of life and is no longer supported.
This story does not have two clearly opposing sides.
Previdian telemetry began recording attack attempts against a separate SonicWall vulnerability, CVE-2026-102255.
SonicWall issued an alert stating that the end-of-life GMS vulnerabilities would not be patched.
The Hacker News and BleepingComputer published reports about the GMS vulnerabilities.
SC Media published a report on SonicWall’s warning.
- Vulnerability 1
- CVE-2026-109593; unauthenticated file-read flaw
- Vulnerability 2
- CVE-2026-109594; post-authentication SQL injection flaw
- Affected software
- SonicWall GMS 9.5.2 and earlier
- Replacement platform
- SonicWall Network Security Manager (NSM)
- Researchers
- Pentest-Tools security researchers
- Customer base
- More than 500,000 customers in over 215 countries and territories
3 sources
What people are saying
The affected product has reached End-of-life (EoL)
As a result, no remediation or security update will be released for these vulnerabilities.
Organizations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM).