SonicWall has warned customers that two security flaws affecting its end-of-life Global Management System (GMS) will not be patched. The platform, which lets administrators deploy and manage large numbers of SonicWall security appliances from one interface, has been officially replaced by the Network Security Manager (NSM). The affected versions are GMS 9.5.2 and earlier.

The vulnerabilities

The flaws were found and reported by researchers at Pentest-Tools. They are tracked as:

  • CVE-2026-109593 (CVSS 9.1): an unauthenticated file read vulnerability. An attacker with network access to a vulnerable instance can read internal GMS files and steal sensitive information.
  • CVE-2026-109594: a SQL injection flaw that lets a threat actor with high privileges access or modify information in the GMS database through low-complexity attacks.

No remediation planned

SonicWall stated that because the product has reached end of life, no remediation or security update will be released. The company says organizations still using GMS should understand the associated risks and is strongly encouraging them to upgrade to NSM.

Why it matters

SonicWall products have been a frequent target. Multiple SonicWall vulnerabilities have been exploited as zero-days so far this year, and the US Cybersecurity and Infrastructure Security Agency has added 19 SonicWall flaws to its catalog of actively exploited vulnerabilities over the past four years. Thirteen of those were also abused by ransomware groups. SonicWall reports serving more than 500,000 customers across more than 215 countries and territories.

For defenders, the practical implication is that any GMS 9.5.2 or earlier deployment will remain exposed to these flaws indefinitely. Administrators should inventory remaining GMS instances, restrict network access to them, and plan migration to NSM rather than relying on a patch that will not arrive.