SonicWall Declines to Patch End-of-Life Global Management System Vulnerabilities

SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that the vendor said will not be patched. The security flaws affect SonicWall GMS 9.5.2 and earlier versions.

CVE-2026-109593 (CVSS score: 9.1) is an unauthenticated file read vulnerability that could allow an attacker with network access to read internal GMS files. CVE-2026-109594 permits alteration of database records within the GMS environment. Both vulnerabilities affect end-of-life software, and SonicWall has stated that no patches will be released for the impacted versions.

The company advises organizations still running these end-of-life deployments to upgrade to a supported version of GMS or, if immediate upgrading is not feasible, to isolate affected GMS instances from network access to reduce the risk of exploitation. As of the advisory publication, no confirmed active exploitation in the wild had been reported, though the vulnerabilities remain exploitable by remote, unauthenticated attackers.