SonicWall Warns of Two Unpatched Flaws in End-of-Life GMS

SonicWall has warned customers about two security flaws in its end-of-life Global Management System (GMS) software. The company says it will not release patches for the affected product.

GMS lets IT administrators manage thousands of SonicWall security appliances through one interface. SonicWall has replaced it with Network Security Manager (NSM). The flaws affect GMS 9.5.2 and earlier and were reported by security researchers at Pentest-Tools.

The first flaw, CVE-2026-109593, could let an unauthenticated attacker with network access read internal files and steal sensitive information. The second, CVE-2026-109594, could let an attacker with high privileges access or modify information in the GMS database through a low-complexity SQL injection attack.

SonicWall said the product has reached end of life, so no remediation or security update will be released. It urged organizations still using GMS to upgrade to NSM.

The company’s warning comes amid a history of attacks against its products. Over the last four years, the US Cybersecurity and Infrastructure Security Agency (CISA) added 19 SonicWall vulnerabilities to its list of actively exploited flaws; ransomware gangs also abused 13 of them.