SonicWall Warns of Unpatched GMS Flaws
Two newly disclosed vulnerabilities in end-of-life SonicWall GMS software will receive no security updates, prompting a push to upgrade to NSM.
Updated on Nov. 4, 2026 in Cybersecurity
SonicWall warned customers of two unpatched security flaws in its end-of-life Global Management System (GMS) software, affecting version 9.5.2 and earlier. The company said no remediation or security update will be released, and urged customers to move to its Network Security Manager (NSM) platform.
Why it matters
GMS is used by IT administrators to deploy and manage SonicWall security appliances, so unpatched flaws in it leave managed networks exposed. SonicWall's history of exploited vulnerabilities makes the lack of patches a notable risk for customers worldwide.
CVE-2026-109593 lets unauthenticated attackers with network access read internal files to steal sensitive information, while CVE-2026-109594 allows high-privilege threat actors to read or modify the GMS database through low-complexity SQL injection. Pentest-Tools researchers reported both flaws, and it is not stated whether either has been exploited in the wild.
The players
SonicWall
SonicWall is a cybersecurity company that sells firewalls and network security appliances, serving more than 500,000 customers in over 215 countries and territories through about 17,000 partners.
Pentest-Tools
Pentest-Tools is a security testing company whose researchers found and reported the two GMS vulnerabilities.
CISA
The Cybersecurity and Infrastructure Security Agency is the U.S. federal agency that maintains the catalog of actively exploited vulnerabilities, to which it has added 19 SonicWall flaws over four years.
The details
SonicWall said it will not release fixes for the two vulnerabilities because GMS has reached end-of-life, and it recommended customers upgrade to the Network Security Manager platform, which replaced GMS. The flaws were found and reported by Pentest-Tools security researchers and affect systems running GMS 9.5.2 and earlier.
Timeline
Tuesday, November 3, 2026: SonicWall urged customers to upgrade to NSM and warned of end-of-life risks.
November 4, 2026: Reporting on the GMS flaw warning circulated this week.
Under the Hood
SonicWall products account for 19 entries in CISA's Known Exploited Vulnerabilities catalog over the past four years, and 13 of those were also abused by ransomware gangs. The GMS disclosure extends that record to a management platform that will not be patched at all.
Organizations running SonicWall GMS 9.5.2 or earlier should plan migration to Network Security Manager, since no security update will be issued for the affected version. Until migration is complete, administrators should restrict network access to GMS instances to limit exposure to the reported flaws.
The takeaway
End-of-life security tools can remain a serious exposure long after support ends, so inventorying management platforms and their retirement dates is a practical first step. Organizations should treat vendor end-of-life notices as a prompt to migrate, not as a routine lifecycle update.
Further reading
For more on how vendors handle flaws in retired products, see our Cybersecurity coverage.
