SonicWall warns of unpatched flaws in end-of-life GMS software

SonicWall has disclosed two vulnerabilities in its end-of-life Global Management System (GMS) that will remain unpatched, pushing customers to migrate to the newer Network Security Manager platform instead. Discovered by Pentest-Tools researchers, the flaws hit GMS version 9.5.2 and earlier: CVE-2026-109593 lets an unauthenticated attacker with network access read internal files and extract sensitive data, while CVE-2026-109594 allows a highly privileged attacker to run SQL injection attacks to view or alter data in the GMS database. Since GMS has reached end-of-life, SonicWall says no security updates will be issued and recommends upgrading to NSM to avoid the risk. This comes amid a string of SonicWall zero-day exploitations throughout the year, with CISA having listed 19 SonicWall vulnerabilities as actively exploited over the past four years, 13 of them tied to ransomware operations.