SonicWall will not patch end-of-life GMS flaws
Original title: SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
SonicWall confirmed two vulnerabilities in end-of-life Global Management System that will not be fixed.
SonicWall warned about two flaws in GMS 9.5.2 and earlier. CVE-2026-109593 is an unauthenticated file read vulnerability. CVE-2026-109594 is a post-authentication SQL injection vulnerability. The product has reached end-of-life so no remediation will be released. Users should upgrade to the Network Security Manager. One month earlier SonicWall fixed a different critical flaw that has seen active exploitation.
Unconfirmed: no exploitation of these specific flaws reported
- Affects GMS 9.5.2 and earlier
- No updates planned for these CVEs
- Upgrade to Network Security Manager recommended
- Separate SSRF flaw actively exploited
Impact: read internal files or alter database records
| Product | Affected |
|---|---|
| SonicWall Global Management System | 9.5.2 and earlier |
- 1.upgrade to Network Security Manager
- Vendors
- SonicWall
- Products
- Global Management System
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109593+1 related CVE | Unauthenticated file read in SonicWall GMS 9.5.2 and earlier | 9.1 group max | — |
From the original article
1 min read at thehackernews.com
SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9. 5.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.