SonicWall Will Not Patch Critical Vulnerabilities in End-of-Life GMS

SonicWall has confirmed it will not issue security patches for two critical vulnerabilities affecting its end-of-life (EoL) Global Management System (GMS). The flaws impact GMS version 9.5.2 and all earlier versions, leaving affected systems susceptible to unauthorised file access and database manipulation.

Critical Flaw and Database Risks

One of the security flaws, tracked as CVE-2026-109593, has been assigned a critical CVSS score of 9.1. This unauthenticated file read vulnerability could allow an attacker with network access to read sensitive internal GMS files.

The company also identified a second vulnerability that could enable attackers to alter database records, potentially compromising the integrity of the management system’s data.

Migrating from EoL Systems

As these software versions have reached end-of-life status, SonicWall will not provide further updates or security fixes. When software reaches EoL, vendors typically cease all security support, meaning any newly discovered vulnerabilities will remain permanently unpatched.

Organisations currently utilising GMS 9.5.2 or earlier are advised to migrate to a supported version of the software immediately to mitigate the risk of exploitation.