SonicWall will not patch critical flaws in end of life GMS software

SonicWall has warned customers of two security vulnerabilities in its end of life Global Management System software that will not be patched, The Hacker News and BleepingComputer both reported. The security issues affect systems running SonicWall GMS version 9.5.2 and earlier releases. [1][2][3]

According to The Hacker News, one of the unpatched issues is tracked as CVE-2026-109593 and has a CVSS severity score of 9.1. The publication noted that this issue is an unauthenticated file read vulnerability, which can allow an attacker to expose files and alter database records. BleepingComputer reported that security researchers from Pentest-Tools discovered and reported both vulnerabilities. [1][2]

The Global Management System software allows system administrators to deploy and manage thousands of SonicWall security devices through a single interface, BleepingComputer reported. The vendor has officially replaced the product with its Network Security Manager management platform. [2]

Organizations using the legacy software face ongoing risk, as SonicWall will not release updates for systems that have reached end of life. Security administrators using affected versions must migrate to supported platforms such as Network Security Manager to secure their environments. [1][2]