SonicWall warns of unpatched flaws in end-of-life GMS software

SonicWall has warned customers about two security flaws affecting its Global Management System (GMS) software, but said it will not fix them because the product has reached end of life. GMS allows IT administrators to deploy and manage thousands of SonicWall security appliances from a single interface. The company has officially replaced it with the Network Security Manager (NSM) management platform. The two vulnerabilities were found and reported by security researchers at Pentest-Tools and affect systems running SonicWall GMS 9.5.2 and earlier versions. The first flaw, tracked as CVE-2026-109593, allows unauthenticated attackers with network access to vulnerable instances to steal sensitive information by reading internal files. The second, tracked as CVE-2026-109594, can let threat actors with high privileges access or modify information stored in the GMS database through low-complexity SQL injection attacks. On Tuesday, SonicWall urged customers to upgrade to NSM, confirming that no security patches will be released for the affected systems. "The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities," the company warned. "Organizations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM)." The warning comes amid a pattern of attackers targeting SonicWall products. The company has asked customers to patch multiple SMA1000 zero-day vulnerabilities throughout the year, including flaws disclosed in February and July, as well as three additional SMA1000 flaws exploited as zero-days in September and October. Over the last four years, the US Cybersecurity and Infrastructure Security Agency (CISA) has added 19 SonicWall vulnerabilities to its list of actively exploited flaws, 13 of which have also been abused by ransomware gangs. SonicWall serves more than 500,000 customers, including small and medium-sized businesses, large enterprises, and government agencies, in more than 215 countries and territories through a network of over 17,000 partners. Organizations still running GMS 9.5.2 or earlier are advised to plan a migration to NSM, as the newly disclosed flaws will remain unpatched on end-of-life systems.