SonicWall has warned customers about two unpatched vulnerabilities affecting its end-of-life Global Management System (GMS), including a flaw that could let unauthenticated attackers access internal files and another that could allow privileged attackers to modify database information. The company is urging organizations running GMS 9.5.2 or earlier to migrate to its Network Security Manager (NSM) platform because no security updates will be released for the affected products.
Two vulnerabilities affect SonicWall GMS
SonicWall has replaced GMS, which allowed IT administrators to deploy and manage thousands of SonicWall security appliances through a single interface, with the NSM management platform.
The two vulnerabilities were discovered and reported by security researchers at Pentest-Tools. They affect systems running SonicWall GMS 9.5.2 or earlier.
The first flaw, tracked as CVE-2026-109593, could allow an unauthenticated attacker to gain network access to a vulnerable GMS instance and read internal files. An attacker could use the flaw to steal sensitive information.
The second issue, CVE-2026-109594, could allow a high-privileged attacker to access or modify information stored in the GMS database through a low-complexity SQL injection attack.
No security updates planned for the end-of-life product
SonicWall said Tuesday that the affected GMS products have reached end of life and urged customers to upgrade to NSM. The company warned that no security patches will be released for the vulnerable systems.
“The affected products have reached end of life (EOL). As a result, no fixes or security updates will be released for these vulnerabilities,” SonicWall warned on Tuesday.
“Organizations using this product are aware of the associated security risks and are strongly encouraged to upgrade to SonicWall Network Security Manager (NSM).”
SonicWall vulnerabilities repeatedly targeted
Attackers frequently target SonicWall vulnerabilities in the wild, with multiple flaws exploited in zero-day attacks since the beginning of the year.
SonicWall patched two SMA1000 zero-day vulnerabilities in February, identified as CVE-2026-15409 and CVE-2026-15410, and asked customers to patch two more vulnerabilities in July, identified with the same CVE numbers. The company also patched three other SMA1000 flaws exploited as zero-days: CVE-2026-83548 and CVE-2026-83549 in September, and CVE-2026-102255 in October.
Over the past four years, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog. Thirteen of those vulnerabilities were exploited by ransomware groups.
SonicWall serves more than 500,000 customers, including small and medium-sized businesses, large enterprises and government agencies, in more than 215 countries and territories through a network of more than 17,000 partners.
Source: www.bleepingcomputer.com