SonicWall Says It Won’t Fix Two Vulnerabilities in End-of-Life GMS

The flaws affect SonicWall GMS 9.5.2 and earlier. One could expose internal files without authentication; the other could let an authenticated attacker access or modify database information under specific conditions.

4 Nov 2026

SonicWall Says It Won’t Fix Two Vulnerabilities in End-of-Life GMS

SonicWall has warned that two vulnerabilities affecting Global Management System (GMS) 9.5.2 and earlier will not receive security updates because the product has reached end of life (EoL). The company recommends that organizations using GMS upgrade to SonicWall Network Security Manager (NSM).

CVE-2026-109593 has a CVSS score of 9.1 and is an unauthenticated file-read vulnerability. An attacker with network access could use it to read internal GMS files, potentially exposing sensitive information.

The second flaw, CVE-2026-109594, has a CVSS score of 6.8. It is a post-authentication SQL injection vulnerability that could allow an authenticated attacker, under specific conditions, to access or modify information in the GMS database.

The warning follows SonicWall’s recent release of a fix for CVE-2026-102255, a critical pre-authentication server-side request forgery vulnerability. The flaw has since been exploited in the wild. Telemetry from Previdian recorded 2,541 attempts from eight unique IP addresses in Singapore and the United States since October 9, 2026, including as many as 30 attempts on November 3.

Sources: The Hacker News.