[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZCTfEEiH1E-I5IBCT_30y2GKDh-IbElpkC8rZ0lI_5w":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"ebc3460a-653a-4a63-8099-57766eec0920","sonicwall-refuses-to-patch-critical-eol-gms-flaws-leaving-users-exposed","8ca15b9b-19ad-4516-a28f-9d65370fe6ba","SonicWall Refuses to Patch Critical EoL GMS Flaws, Leaving Users Exposed","SonicWall's decision not to patch two high-severity vulnerabilities in end-of-life GMS 9.3.2 and earlier — including an unauthenticated file read (CVSS 9.1) and a SQL injection flaw — highlights the acute risk of running unsupported software in production environments. Organizations that delay migrating away from EoL products inherit all future vulnerabilities with no vendor safety net, while adversaries actively probe for exactly these unpatched systems. The active exploitation of a related SSRF flaw (over 2,500 documented attempts) confirms that threat actors specifically target legacy SonicWall infrastructure. This situation matters because network management systems typically have privileged access to the entire security stack, meaning a single compromise can cascade across the entire environment. Maintaining an accurate EoL tracking program is not optional — it is a foundational security hygiene requirement.","**Immediate actions:**\n- Upgrade all SonicWall GMS 9.3.2 and earlier deployments to the supported Network Security Manager (NSM) platform immediately.\n- Isolate or firewall any EoL GMS instances from internet-facing exposure until migration is complete.\n- Run an emergency authenticated scan of GMS systems to detect any signs of SQL injection or unauthorized file access exploitation.\n\n**Long-term improvements:**\n- Maintain a continuously updated asset inventory that flags software approaching or past its vendor end-of-life date, triggering a mandatory migration plan.\n- Establish a formal EoL policy that requires approved migration timelines and risk-acceptance sign-off at the CISO level for any system running beyond vendor support.\n- Implement network segmentation to ensure management platforms like GMS are never directly reachable from untrusted networks or the public internet.\n\n**Detection measures:**\n- Deploy file integrity monitoring and database activity monitoring on management systems to detect anomalous file reads or unexpected SQL queries indicative of exploitation.\n- Integrate threat intelligence feeds into your SIEM to alert on known CVEs actively being exploited in the wild, enabling faster response when vendor patches are unavailable.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"OWASP A06:2021 Vulnerable and Outdated Components":24,"CIS Control 7: Continuous Vulnerability Management":25,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":26},"NIS2 mandates that operators of essential services handle vulnerabilities and perform risk assessments; continued use of unsupported management software with known critical CVEs directly violates this obligation.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches and retiring unsupported software, making continued GMS 9.3.2 use non-compliant in cardholder data environments.","SI-2 requires organizations to identify, report, and correct information system flaws; when a vendor will not issue a patch, the control mandates compensating controls or migration to a supported product.","With over 2,500 active exploitation attempts documented against related SonicWall flaws, organizations without a tested incident response plan for network appliance compromise will struggle to contain the blast radius.","Running GMS past its end-of-life date is a textbook example of using an outdated component with no available remediation path, exactly the risk OWASP A06 warns organizations to eliminate.","Regular vulnerability scanning would have flagged GMS instances as EoL and unpatched, prompting remediation before active exploitation of the SSRF and file-read flaws began.","This control requires timely identification and remediation of technical vulnerabilities, including maintaining awareness of EoL status and acting before unpatched flaws become exploitable entry points.","published","2026-11-04T18:21:30.487417+00:00","2026-11-04T18:21:30.463+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fsonicwall-wont-patch-eol-gms-flaws-that.html","sonicwall-won-t-patch-eol-gms-flaws-that-could-expose-files-alter-database-recor-28cc7a","SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52,55],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]