SonicWall will not patch two flaws in end-of-life GMS software
Administrators still running GMS 9.5.2 and earlier have no fix coming and will need to migrate to NSM to close the gap.
SonicWall has said it will not patch two vulnerabilities in its end-of-life Global Management System (GMS), covering version 9.5.2 and earlier. The first, CVE-2026-109593 (CVSS 9.1), lets an unauthenticated attacker with network access read internal files and possibly expose sensitive data, while the second, CVE-2026-109594 (CVSS 6.8), is a post-authentication SQL injection that could let an authenticated attacker view or change records in the GMS database under certain conditions. Because the product has reached end of life, no remediation will be issued, and SonicWall is urging customers to move to its Network Security Manager (NSM) platform. The warning comes weeks after a critical SSRF flaw in a different product, CVE-2026-102255 (CVSS 10.0), began seeing active exploitation, which makes the unpatched GMS issues a practical concern for administrators still running it.
Why it matters
Because SonicWall has ended support for GMS, the two flaws will stay open on every installation still in use, including one that an unauthenticated attacker on the network could use to read internal files. The warning arrives while a separate critical flaw in another SonicWall product is being actively exploited, so organisations that have not moved off GMS are left running software whose known weaknesses will not be repaired. Migration to NSM is now the only route SonicWall offers to end that exposure.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.