SonicWall Won’t Patch Two GMS Flaws as the Product Is End-of-Life

Organisations still running SonicWall’s Global Management System (GMS) should plan to retire it or cut off network access to it. SonicWall has disclosed two security flaws in SonicWall GMS and says it will not release fixes, because the product has reached end-of-life.

In its security advisory SNWLID-2026-0019, published on 3 November, SonicWall said: “The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities.” It urged customers to move to its Network Security Manager (NSM). No exploitation of either flaw has been reported.

What defenders should do now

Because no fix is coming, the only lasting remedy is to stop using SonicWall GMS. SonicWall’s stated upgrade path is NSM, its current platform for managing firewalls centrally.

Until a migration is finished, the sensible steps are the standard ones for any unsupported system that cannot be patched:

• Find every GMS instance, including test and backup servers that may have been forgotten.
• Make sure no GMS interface is reachable from the internet.
• Restrict access to GMS to a small set of management hosts or a separate management network.
• Review who holds GMS accounts and remove those that are not needed, since the second flaw requires a login.
• Watch GMS logs for unusual file access or database errors.

These steps reduce the risk but cannot remove the flaws. Any GMS server that stays online remains exposed to them.

The two flaws

The more serious flaw, CVE-2026-109593, is described as an unauthenticated internal file read in GMS 9.5.2 and earlier. According to the US National Vulnerability Database record, published on 3 November, CISA’s ADP scoring gives it a CVSS score of 9.1, which is critical. An attacker would not need an account to use it, which is why it scores so highly.

The second flaw, CVE-2026-109594, is a post-authentication SQL injection with a CVSS score of 6.8. It can only be used by someone who has already logged in, which lowers the risk but does not remove it, particularly where passwords are weak or shared.

CISA’s SSVC assessment lists exploitation as “none”, meaning there were no reports of the flaws being used in attacks when they were published. TSN gives no technical exploit details. That status can change quickly once a flaw is public, so the absence of reported attacks today is not a reason to delay. Defenders who rely on CISA’s Known Exploited Vulnerabilities catalogue to set priorities should note that neither flaw was in it as of its 3 November update.

Why the end-of-life notice matters

This advisory is unusual because it pairs a critical score with a firm statement that no fix will follow. In most advisories, the advice is to patch. Here, SonicWall is saying the product itself is the problem, and the only fix is to replace it.

That matters because management systems hold a privileged position on a network. A tool built to configure many firewalls can expose settings, credentials and other internal data if it is compromised. A file-read flaw that needs no login is the kind of bug attackers look for in such tools. No attacks have been reported, but the details are now public and will stay public.

SonicWall products have drawn attackers before. TSN reported last week on attack attempts against a patched SonicWall SMA1000 flaw. Older, known flaws are also a common way in for ransomware groups, as a joint advisory on SafePay ransomware showed. When a flaw in an edge device is exploited, as with the Ivanti Connect Secure zero-day, the window for defenders can be short. With GMS, that window will never be closed by a patch.

For teams that have put off a migration, the advisory also changes the cost of waiting. Before, an old GMS server was a support and maintenance question. Now it is a known, documented weakness with a published severity score, which auditors, insurers and security teams can all see. Moving to NSM takes planning, but each week a GMS server stays reachable is a week of exposure that no update will reduce.

Sources

• SonicWall PSIRT: Security advisory SNWLID-2026-0019 (3 November 2026)
• NVD: CVE-2026-109593 (published 3 November 2026)

Related stories

• SonicWall Flaw Probed, Pwn2Own Pays $1.26m and Windows Update Deadline
• SafePay Ransomware Hit 600 Victims via Old Flaws, Agencies Warn
• Attackers Are Exploiting an Ivanti Connect Secure Zero-Day, and CISA Gives US Agencies Until 16 October to Act