SonicWall warns of unpatched flaws in end-of-life GMS software
SonicWall warns of two unpatched vulnerabilities in end-of-life GMS software.
SonicWall has alerted customers to two critical security flaws in its end-of-life Global Management System (GMS) software, versions 9.5.2 and earlier. These vulnerabilities, CVE-2026-109593 and CVE-2026-109594, allow unauthenticated attackers to steal sensitive information or conduct SQL injection attacks. As GMS is no longer supported, SonicWall will not release patches and strongly advises users to migrate to the newer Network Security Manager (NSM) platform.
AI summary of the linked source. Not reviewed by an editor. How this works
Run SonicWall?
Get an email when a new story names SonicWall, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonSonicWall's Global Management System (GMS) versions 9.5.2 and earlier contain two critical unpatched vulnerabilities that allow unauthenticated attackers to steal sensitive data or perform SQL injection attacks. Because the software has reached end-of-life, SonicWall will not issue patches, leaving any organization still running GMS permanently exposed. This incident highlights the severe risk of continuing to operate unsupported software in production environments, particularly network management platforms that hold privileged credentials and configuration data. Organizations must treat end-of-life software as a critical vulnerability in its own right and have migration timelines well before vendor support ends.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-109593
- cve — CVE-2026-109594