SonicWall won't patch two GMS flaws because the product is end-of-life
The vendor advisory covers GMS 9.5.2 and earlier. One flaw is an unauthenticated file read rated 9.1; the other can alter database records. Neither gets a fix.
SonicWall has published details of two vulnerabilities in Global Management System (GMS) 9.5.2 and earlier, and says it won't patch either one. The product is end-of-life, so the flaws stay open on anything still running it.
The first, CVE-2026-109593, is an unauthenticated file read. An attacker who can reach GMS over the network may be able to read internal GMS files, which the advisory says could expose sensitive information. The CVSS score is 9.1. The second flaw, per The Hacker News, could let an attacker alter database records. The article gives no CVE for it and no score.
The vendor advisory is the place to check the exact wording. Neither the article nor the advisory excerpt says whether anyone has exploited either bug, and there's no mention of a workaround or a migration path. GMS is the console that manages SonicWall firewalls, so a file read there is worth taking seriously if the box is still in service.
What to check first: whether you still run GMS at all, and whether it's reachable from anything other than a management network. If it is, the fix isn't a patch. It's getting off the product. We'd treat a 9.1 unauthenticated read on a management console as a reason to move that timeline up rather than wait for a vendor change of heart.
CVE references
Sources
- SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database RecordsPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning