SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records

SonicWall has disclosed two security flaws in its Global Management System (GMS) version 9.5.2 and earlier, but says it will not release fixes since the product has reached end-of-life. CVE-2026-109593, rated 9.1 on the CVSS scale, lets an unauthenticated attacker with network access retrieve internal GMS files and expose sensitive data. CVE-2026-109594, scored 6.8, is a post-authentication SQL injection bug that could let a logged-in attacker view or tamper with database records under certain conditions. The vendor is urging affected organizations to move to SonicWall Network Security Manager (NSM) instead, noting that no patches are forthcoming for GMS. This disclosure follows closely on the heels of SonicWall's fix last month for CVE-2026-102255, a maximum-severity (CVSS 10.0) pre-auth SSRF bug in a different product that is already being actively exploited, with thousands of attack attempts logged since early October.