[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9KqaBKUJhsLmief9NAK5Y3lBmE_OIrZYaK9sLAPukN4":3},{"article":4,"iocs":36,"watch_terms":47,"solutions":48,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"8ca15b9b-19ad-4516-a28f-9d65370fe6ba","SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records","sonicwall-won-t-patch-eol-gms-flaws-that-could-expose-files-alter-database-recor-28cc7a","SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below - CVE-2026-109593 (CVSS score: 9.1) - An unauthenticated file read vulnerability that could allow an attacker with network access to read internal GMS files,","SonicWall announced two unpatched vulnerabilities in end-of-life Global Management System (GMS) 9.5.2 and earlier: CVE-2026-109593 (CVSS 9.1), an unauthenticated file read flaw, and CVE-2026-109594 (CVSS 6.8), a post-authentication SQL injection vulnerability. The vendor will not release fixes due to EoL status and recommends users upgrade to SonicWall Network Security Manager (NSM). This disclosure follows active exploitation of a critical SSRF flaw (CVE-2026-102255) with 2,541 documented attack attempts.","SonicWall won't patch two critical EoL GMS vulnerabilities exposing files and database records.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fsonicwall-wont-patch-eol-gms-flaws-that.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgME1T4MkjI8UEzzSmlLgbPG6a__VNQNoKkhuxiaW5zF5fnHLPmsTdkGoIL06JTeER1jcOMH-WLuNYyva_sSW_8DnZojbMC8ikgNME3ZPUAdkij-9nVm8joHHdaZRoLNbVgcSVLNSc6Tt7UJ3YPhQmea3OtQwg-H2UzUPIgWq7nFwoEQcMsGCKf-0fImEvd\u002Fs1600\u002Fsonic.jpg","2026-11-04T17:00:38+00:00","2026-11-04T18:00:28.527969+00:00",9,[17,20,23,25],{"name":18,"type":19},"SonicWall","vendor",{"name":21,"type":22},"SonicWall Global Management System (GMS)","product",{"name":24,"type":22},"SonicWall Network Security Manager (NSM)",{"name":26,"type":27},"SSRF","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},[37,41,44],{"type":38,"value":39,"context":40},"cve","CVE-2026-109593","Unauthenticated file read vulnerability in SonicWall GMS 9.5.2 and earlier (CVSS 9.1)",{"type":38,"value":42,"context":43},"CVE-2026-109594","Post-authentication SQL injection vulnerability in SonicWall GMS 9.5.2 and earlier (CVSS 6.8)",{"type":38,"value":45,"context":46},"CVE-2026-102255","Critical pre-authenticated SSRF flaw in SonicWall (CVSS 10.0), under active exploitation",[18,21,24],{"controls":49,"vendors":129},[50,79,104],{"slug":51,"name":52,"problem":53,"products":54},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":80,"name":81,"problem":82,"products":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":80,"product_name":101,"url":102,"description":103},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":105,"name":106,"problem":107,"products":108},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[109,114,122],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":110,"product_name":111,"url":112,"description":113},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":124,"url":127,"description":128},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",[130],{"slug":131,"name":18,"logo_path":132,"roles":133},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[134],"affected",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":147},"sonicwall-refuses-to-patch-critical-eol-gms-flaws-leaving-users-exposed","SonicWall Refuses to Patch Critical EoL GMS Flaws, Leaving Users Exposed","SonicWall's decision not to patch two high-severity vulnerabilities in end-of-life GMS 9.3.2 and earlier — including an unauthenticated file read (CVSS 9.1) and a SQL injection flaw — highlights the acute risk of running unsupported software in production environments. Organizations that delay migrating away from EoL products inherit all future vulnerabilities with no vendor safety net, while adversaries actively probe for exactly these unpatched systems. The active exploitation of a related SSRF flaw (over 2,500 documented attempts) confirms that threat actors specifically target legacy SonicWall infrastructure. This situation matters because network management systems typically have privileged access to the entire security stack, meaning a single compromise can cascade across the entire environment. Maintaining an accurate EoL tracking program is not optional — it is a foundational security hygiene requirement.",[140,141,142,143,144,145,146],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":148,"PCI DSS Requirement 6":149,"NIST SP 800-53 SI-2: Flaw Remediation":150,"CIS Control 17: Incident Response Management":151,"OWASP A06:2021 Vulnerable and Outdated Components":152,"CIS Control 7: Continuous Vulnerability Management":153,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":154},"NIS2 mandates that operators of essential services handle vulnerabilities and perform risk assessments; continued use of unsupported management software with known critical CVEs directly violates this obligation.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches and retiring unsupported software, making continued GMS 9.3.2 use non-compliant in cardholder data environments.","SI-2 requires organizations to identify, report, and correct information system flaws; when a vendor will not issue a patch, the control mandates compensating controls or migration to a supported product.","With over 2,500 active exploitation attempts documented against related SonicWall flaws, organizations without a tested incident response plan for network appliance compromise will struggle to contain the blast radius.","Running GMS past its end-of-life date is a textbook example of using an outdated component with no available remediation path, exactly the risk OWASP A06 warns organizations to eliminate.","Regular vulnerability scanning would have flagged GMS instances as EoL and unpatched, prompting remediation before active exploitation of the SSRF and file-read flaws began.","This control requires timely identification and remediation of technical vulnerabilities, including maintaining awareness of EoL status and acting before unpatched flaws become exploitable entry points."]