[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqt02gSXa_F0FrQjekTZPwe5YOHnkqe8QdABTK8F6iwA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"b2b61942-98d7-4483-85a3-b2fabd635106","sonicwall-end-of-life-gms-flaws-leave-users-exposed-with-no-patch-coming","d985ae50-7941-4e9c-bfb5-2571e490ae84","SonicWall End-of-Life GMS Flaws Leave Users Exposed with No Patch Coming","SonicWall's Global Management System (GMS) versions 9.5.2 and earlier contain two critical unpatched vulnerabilities that allow unauthenticated attackers to steal sensitive data or perform SQL injection attacks. Because the software has reached end-of-life, SonicWall will not issue patches, leaving any organization still running GMS permanently exposed. This incident highlights the severe risk of continuing to operate unsupported software in production environments, particularly network management platforms that hold privileged credentials and configuration data. Organizations must treat end-of-life software as a critical vulnerability in its own right and have migration timelines well before vendor support ends.","**Immediate actions:**\n- Migrate all GMS 9.5.2 and earlier deployments to SonicWall Network Security Manager (NSM) or an equivalent supported platform immediately.\n- Isolate or take offline any GMS instances that cannot be migrated immediately to prevent unauthenticated remote exploitation.\n- Conduct a network-wide audit to identify all other end-of-life or unsupported software currently in use.\n\n**Long-term improvements:**\n- Maintain a formal software lifecycle inventory that tracks vendor support end dates and triggers migration projects at least 12 months before EOL.\n- Establish a policy requiring executive sign-off and a documented risk acceptance for any software continued in use beyond vendor end-of-life.\n- Integrate vendor EOL announcements into the organization's vulnerability management program so they are treated with the same urgency as CVEs.\n\n**Detection measures:**\n- Deploy continuous vulnerability scanning tools configured to flag unsupported and end-of-life software versions across all networked assets.\n- Monitor network traffic to and from management platforms for anomalous unauthenticated access attempts or unexpected SQL query patterns.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 mandates that essential and important entities handle vulnerabilities through appropriate technical measures, which includes planning for and executing migrations away from unsupported software that cannot be patched.","PCI DSS Requirement 6 mandates that all system components are protected from known vulnerabilities by installing applicable security patches; end-of-life software with no available patch is non-compliant by definition and must be replaced.","SI-2 requires organizations to identify, report, and correct information system flaws, and to replace software when vendor remediation is no longer available, directly addressing the obligation to migrate off unsupported GMS.","GMS 9.5.2 is a textbook example of an outdated, unsupported component; OWASP A06 explicitly warns that using software without security patches or past its support life introduces exactly this class of critical risk.","A continuous vulnerability management program would have flagged GMS as end-of-life and critically exposed, triggering a mandatory migration before these CVEs were disclosed.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, including replacing software for which no patch can be obtained from the vendor.","The CVEs allow unauthenticated access to a privileged network management platform; enforcing authentication controls and limiting exposure of management interfaces would have reduced the attack surface while migration was underway.","published","2026-11-04T15:20:24.189098+00:00","2026-11-04T15:20:24.175+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fsonicwall-warns-of-unpatched-flaws-in-end-of-life-gms-software\u002F","sonicwall-warns-of-unpatched-flaws-in-end-of-life-gms-software-803d0b","SonicWall warns of unpatched flaws in end-of-life GMS software",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52,55],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]