SonicWall Won't Patch End-of-Life GMS Vulnerabilities, Citing Risks

SonicWall has issued a stark warning to its customers regarding two critical vulnerabilities present in older, end-of-life (EoL) versions of its Global Management System (GMS). The company has explicitly stated that no security updates or remediation will be provided for these flaws, urging organizations to migrate to its current Network Security Manager (NSM) solution.

The vulnerabilities, identified as CVE-2026-109593 and CVE-2026-109594, pose significant risks to organizations still relying on the unsupported GMS versions. CVE-2026-109593 is a critical unauthenticated file read vulnerability with a CVSS score of 9.1. This flaw could allow an attacker with network access to read sensitive internal GMS files, potentially leading to the exposure of confidential information.

The second vulnerability, CVE-2026-109594, is a post-authentication SQL injection flaw with a CVSS score of 6.8. While requiring authentication, this vulnerability could enable an attacker to access or modify data within the GMS database under specific circumstances. The lack of patches for these issues leaves any organization using the affected GMS versions exposed to potential data breaches and system compromise.

SonicWall's decision not to patch these vulnerabilities is directly tied to the product's end-of-life status. The company's alert emphasizes that "the affected product has reached End-of-life (EoL)," and consequently, "no remediation or security update will be released." This stance underscores the inherent risks associated with using unsupported software, which often becomes a prime target for threat actors seeking to exploit known, unpatched weaknesses.

This announcement comes shortly after SonicWall released fixes for a different critical vulnerability, CVE-2026-102255, a pre-authenticated server-side request forgery (SSRF) flaw. This SSRF vulnerability, rated with a perfect CVSS score of 10.0, was actively exploited in the wild, with telemetry data indicating thousands of attack attempts from multiple IP addresses. The active exploitation of the previously patched SSRF highlights the urgency with which such vulnerabilities are targeted.

The active exploitation of the SSRF flaw serves as a potent reminder of the threat landscape surrounding network management systems. Organizations that fail to upgrade from EoL products like the affected GMS versions are essentially leaving their networks vulnerable to known exploits. The potential impact ranges from sensitive data exposure to unauthorized system modifications, which can have severe operational and financial consequences.

Security researchers and vendors consistently advise organizations to maintain an up-to-date inventory of their software and hardware assets and to prioritize migration away from end-of-life products. The risks associated with unpatched vulnerabilities in legacy systems often outweigh the costs of upgrading to modern, supported solutions. SonicWall's proactive communication about the unpatched GMS flaws, while unfortunate for those affected, is a necessary step in alerting customers to the immediate risks they face.

Customers still utilizing the vulnerable GMS versions are strongly encouraged to transition to SonicWall's Network Security Manager (NSM) to mitigate these risks. This situation emphasizes the critical importance of a robust patch management strategy and a commitment to using supported software to maintain a strong security posture against evolving cyber threats.