SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records

SonicWall's decision not to patch two high-severity vulnerabilities in end-of-life GMS 9.3.2 and earlier — including an unauthenticated file read (CVSS 9.1) and a SQL injection flaw — highlights the acute risk of running unsupported software in production environments. Organizations that delay migrating away from EoL products inherit all future vulnerabilities with no vendor safety net, while adversaries actively probe for exactly these unpatched systems. The active exploitation of a related SSRF flaw (over 2,500 documented attempts) confirms that threat actors specifically target legacy SonicWall infrastructure. This situation matters because network management systems typically have privileged access to the entire security stack, meaning a single compromise can cascade across the entire environment. Maintaining an accurate EoL tracking program is not optional — it is a foundational security hygiene requirement.