SonicWall Won't Patch End-of-Life GMS Flaws That Let Attackers Read Files Unauthenticated

SonicWall has found two security holes in the software many companies use to run their SonicWall fleets, and it is not going to fix either of them. The product is end of life, so customers still running it are on their own.

The flaws sit in Global Management System, or GMS, the console that lets IT admins deploy and manage thousands of SonicWall security appliances from a single interface. SonicWall has officially replaced it with Network Security Manager, and Tuesday's alert made the cutoff explicit: no remediation or security update will be released.

The worse of the two

The serious one is CVE-2026-109593, rated 9.1 on the CVSS scale. It lets an attacker with network access read internal GMS files without logging in, which can expose sensitive information. It affects GMS 9.5.2 and earlier.

The second, CVE-2026-109594, scores 6.8. It is a SQL injection that requires authentication, and under specific conditions it lets an attacker access or modify information in the GMS database.

Researchers at Pentest-Tools found and reported both bugs. SonicWall has not said the flaws are being exploited, and the advisories do not describe any attacks in the wild.

Why a management console matters

GMS does not process traffic the way a firewall does, and the flaws do not make every SonicWall box vulnerable. But a management server holds the keys to the fleet. A tool built to configure thousands of devices from one place is exactly the kind of system where leaked files and a tampered database can do outsized damage.

That is the uncomfortable part of end of life. The software still works, still sits on corporate networks and still has access to everything it manages. It just stops getting fixes.

Two vendors, two answers

The timing is rough for anyone who looks after network gear. Zyxel owners just learned that a zero-day kept working after the June patch on their GS1900 switches, forcing a late second fix. That patch at least arrived. SonicWall is telling GMS shops there will be no fix at all.

Other vendors spent the same week shipping patches for their own products. SonicWall's answer is a migration. The company is strongly encouraging organizations to upgrade to Network Security Manager, and until they do, every GMS install at version 9.5.2 or earlier carries two known, permanent holes.

Some offers on this page may be paid placements or contain affiliate links.