SonicWall has declared it will no longer issue fixes for serious security flaws in its Global Management System (GMS), versions 9.5.2 and earlier, because the product has reached End-of-Life status. These exposed vulnerabilities include both remote file reading without authentication and SQL injection after authentication, each posing distinct threats to data integrity and confidentiality.
What’s at Risk
The first vulnerability, CVE-2026-109593 (CVSS 9.1), permits an unauthenticated attacker with network access to read internal GMS files, potentially leaking sensitive information. The second flaw, CVE-2026-109594 (CVSS 6.8), involves a post-authentication SQL injection that could allow a user to alter or retrieve database records under certain conditions. Because these vulnerabilities affect an End-of-Life product, vendors will not release new patches.
The Reality of End-of-Life & Recommendations
SonicWall explicitly states it will not issue remediation or security updates for these issues, highlighting that both flaws impact GMS 9.5.2 and earlier—systems that have reached EoL. Organizations still operating on those versions are warned of elevated risks. SonicWall recommends migrating to its newer Network Security Manager (NSM) to regain security support and updates.
This announcement arrives shortly after SonicWall addressed CVE-2026-102255, a critical (CVSS 10.0) SSRF flaw allowing unauthenticated attackers to reach internal resources. That vulnerability has been under active attack, with thousands of attempts logged since early October 2026.
Security teams should review their exposure: does the network still run GMS? If so, prioritizing migration is essential. Any delay increases the chance of an attacker exploiting these or other unpatched vulnerabilities.
What This Means:Being on unsupported software today means ignoring root causes of risk—leaving systems defenseless and data vulnerable. For companies, it’s not just about avoiding patches, but staying ahead of exposure. The shift away from GMS toward NSM reflects a broader pattern: legacy software lifecycles require proactive planning. Going forward, track end-of-support timelines, maintain inventory of critical systems, and ensure you’re always able to apply vendor updates. Let this be a lesson: upgrade paths aren’t optional—they’re essential insurance against rising threats.
