"The affected product has reached End-of-life (EoL)," SonicWall said in a Tuesday alert.
End-of-life for GMS and SonicWall's upgrade instruction
SonicWall announced two vulnerabilities that affect its Global Management System (GMS) 9.5.2 and earlier versions and said it will not provide patches because the product has reached end-of-life. "As a result, no remediation or security update will be released for these vulnerabilities," the company warned, and it "strongly encouraged" organizations using the product to upgrade to the SonicWall Network Security Manager (NSM).
CVE-2026-109593: unauthenticated file read (CVSS 9.1)
The first vulnerability, CVE-2026-109593, carries a CVSS score of 9.1. SonicWall described it as an unauthenticated file read flaw that could allow an attacker with network access to read internal GMS files, potentially exposing sensitive information. Because the issue does not require authentication, any actor with network reach to a vulnerable GMS instance could attempt to retrieve files held inside the appliance.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogCVE-2026-109594: post-authentication SQL injection (CVSS 6.8)
The second reported flaw, CVE-2026-109594, carries a CVSS score of 6.8 and is a post-authentication SQL injection vulnerability. SonicWall says this could allow an authenticated attacker, under specific conditions, to access or modify information stored in the GMS database. The requirement for authentication and those unspecified conditions narrow the surface compared with CVE-2026-109593, but the advisory nonetheless identifies a path for attackers who already hold valid credentials.
Context: recent fix for CVE-2026-102255 and active exploitation telemetry
The advisory arrives less than a month after SonicWall released fixes for CVE-2026-102255, a critical pre-authenticated server-side request forgery (SSRF) flaw assigned a CVSS score of 10.0. That SSRF vulnerability has since come under active exploitation in the wild. Previdian's telemetry, cited in reporting on the matter, recorded 2,541 attack attempts against CVE-2026-102255 from eight unique IP addresses located in Singapore and the U.S. beginning October 9, 2026. As many as 30 exploitation attempts were registered on November 3, 2026.
How technologists, procurement leaders, and defenders are likely to respond
- Technologists and security teams — Faced with two unpatchable flaws in EoL GMS, teams will need to prioritize inventory and exposure assessment for any instances of GMS 9.5.2 or earlier on their networks and plan migrations to SonicWall Network Security Manager (NSM), as SonicWall has explicitly recommended.
- Procurement and IT leaders — Organizations that still run GMS will have to weigh the operational cost of migration against the known risk: SonicWall will not supply remediation or security updates for these CVEs. Procurement decisions now include the upgrade path to NSM or replacement with other management tooling.
- Defenders and incident response — The recent active exploitation of CVE-2026-102255, reflected in Previdian's telemetry, underlines that GMS-related vulnerabilities can attract scanning and automated attack traffic; defenders will have to watch network logs for evidence of attempted reads or SQL injection probes and treat exposed GMS instances as high risk.
SonicWall's dual message is stark: two vulnerabilities affecting GMS 9.5.2 and earlier will not be patched because the product is EoL, and organizations are "strongly encouraged" to move to NSM. At the same time, recent exploitation activity against a separate, recently fixed SonicWall flaw shows that any unpatched or EoL management appliance can be a magnet for attackers. For defenders, the next concrete steps are visible in SonicWall's advisory — identify GMS assets, assume they are vulnerable, and execute the migration or mitigation path that procurement and operations approve.
