SonicWall has warned customers about two security vulnerabilities affecting its end-of-life Global Management System (GMS) software that will not be patched, urging organisations to upgrade to the Network Security Manager (NSM) platform.
The vulnerabilities, identified and reported by Pentest-Tools security researchers, affect systems running SonicWall GMS 9.5.2 and earlier. The first, tracked as CVE-2026-109593, allows unauthenticated attackers with network access to vulnerable instances to steal sensitive information by reading internal files. The second, CVE-2026-109594, enables threat actors with high privileges to access or modify information stored in the GMS database through low-complexity SQL injection attacks.
SonicWall warned on Tuesday that it will not release security patches because the affected systems have reached end of life. “The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities,” the company warned. “Organizations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM).”
GMS helps IT administrators deploy and manage thousands of SonicWall security appliances from a single interface. The company has officially replaced it with NSM.
Attackers have frequently targeted SonicWall vulnerabilities in the wild, exploiting multiple zero-day flaws since the start of the year. Over the past four years, the US Cybersecurity and Infrastructure Security Agency (CISA) has added 19 SonicWall vulnerabilities to its list of actively exploited flaws, 13 of which have also been abused by ransomware gangs.
SonicWall serves more than 500,000 customers, including small and medium-sized businesses, large enterprises, and government agencies, across more than 215 countries and territories.
Analysis
Why This Matters
- Organisations still using the end-of-life GMS software face unpatched vulnerabilities that could lead to data theft or database compromise.
- Attackers have a history of targeting SonicWall flaws, increasing the likelihood of exploitation of these newly disclosed issues.
- The absence of patches means the only effective mitigation is migrating to the supported NSM platform, a process that may take time and resources.
Background
SonicWall Global Management System (GMS) is a tool for centrally deploying and managing security appliances. The company ended support for GMS, replacing it with the Network Security Manager (NSM) platform. The two vulnerabilities announced this week affect GMS 9.5.2 and earlier. SonicWall has patched multiple other zero-days in its SMA1000 products throughout 2026, and CISA has flagged numerous SonicWall flaws as actively exploited.
What to Watch
- Whether CISA adds these GMS vulnerabilities to its catalogue of known exploited flaws, potentially mandating federal agencies to act.
- Reports of in-the-wild exploitation attempts targeting unpatched GMS instances.
- SonicWall’s communications on transition support for customers still reliant on the end-of-life system.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedSonicWall warned of two unpatched vulnerabilities in its end-of-life GMS software.BleepingComputer: “SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched.”
- SupportedNo security patches will be released because the affected systems have reached end of life, and customers are urged to upgrade to NSM.BleepingComputer: “On Tuesday, SonicWall also urged customers to upgrade to NMS, as it will not release security patches because the vulnerable systems have now reached end of life.”
- SupportedSonicWall warned customers that the two flaws would not be patched and urged them to upgrade.BleepingComputer: “SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched.”
- SupportedPentest-Tools security researchers found and reported the vulnerabilities, which affect SonicWall GMS 9.5.2 and earlier.BleepingComputer: “The two vulnerabilities were found and reported by Pentest-Tools security researchers and affect systems running SonicWall GMS 9.5.2 and earlier.”
- SupportedCVE-2026-109593 allows unauthenticated attackers with network access to steal sensitive information by reading internal files.BleepingComputer: “it enables unauthenticated attackers with network access to vulnerable instances (running GMS 9.5.2 and earlier versions) to steal sensitive information by reading internal files.”
- SupportedCVE-2026-109594 lets high-privilege threat actors access or modify GMS database information through low-complexity SQL injection attacks.BleepingComputer: “that can let threat actors with high privileges access or modify information stored in the GMS database through low-complexity SQL Injection attacks.”
- SupportedSonicWall said on Tuesday that it would not release security patches because the systems had reached end of life.BleepingComputer: “On Tuesday, SonicWall also urged customers to upgrade to NMS, as it will not release security patches because the vulnerable systems have now reached end of life.”
- SupportedSonicWall said: “The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities,”BleepingComputer: “"The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities," SonicWall warned on Tuesday.”
- SupportedSonicWall said: “Organizations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM).”BleepingComputer: “"Organizations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM)."”
- SupportedAttackers often target SonicWall vulnerabilities and have exploited multiple ones in zero-day attacks since the start of the year.BleepingComputer: “Attackers often target SonicWall vulnerabilities in the wild and have exploited multiple ones in zero-day attacks since the start of the year.”
- SupportedOver the last four years, CISA added 19 SonicWall vulnerabilities to its actively exploited list, and 13 were also abused by ransomware gangs.BleepingComputer: “Over the last four years, the US Cybersecurity and Infrastructure Security Agency (CISA) added 19 SonicWall vulnerabilities to its list of actively exploited flaws , 13 of them also abused by ransomware gangs.”
- SupportedSonicWall serves more than 500,000 customers across more than 215 countries and territories.BleepingComputer: “SonicWall serves more than 500,000 customers (including small and medium-sized businesses, large enterprises, and government agencies) in more than 215 countries and territories”
