SonicWall Won't Patch Two Flaws in End-of-Life GMS; Migration to NSM Required

SonicWall confirmed in an early November 2026 statement that two vulnerabilities in Global Management System (GMS) 9.5.2 and earlier — already end-of-life — will not receive security updates. Organizations managing network infrastructure through the legacy console must migrate to Network Security Manager (NSM) or accept the risks of unfixable flaws, one of which carries a CVSS 9.1 score and requires no authentication.

The Two Flaws in Detail

The two vulnerabilities share the same attack surface — SonicWall GMS 9.5.2 and earlier instances — but present distinct risk profiles. According to converging primary sources, CVE-2026-109593 is a pre-authentication file-read vulnerability with a CVSS 9.1 score. The lack of a login requirement makes it exploitable by any actor with network visibility of the target system.

CVE-2026-109594, rated CVSS 6.8, requires authentication as a prerequisite. It is a post-authentication SQL injection that allows alteration of the management database contents with elevated privileges. Although the score is lower, the combination with compromised credentials creates a plausible attack chain.

Both flaws were identified and reported by Pentest-Tools researchers. The external disclosure, rather than an internal vendor discovery, highlights an industry pattern: visibility into legacy products decays faster than their actual removal from operational infrastructure.

"The affected product has reached End-of-life (EoL). As a result, no remediation or security update will be released for these vulnerabilities. Organizations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM)." — SonicWall, quoted by BleepingComputer and The Hacker News

Why SonicWall Closed the Case

SonicWall's position is explicit: GMS has completed its supported lifecycle and the vendor will not issue fixes. This practice is common in the technology industry, but it carries weight when the abandoned product is a security management console — a critical component of the defensive architecture for many organizations.

SonicWall's installed base is significant: over 500,000 customers in more than 215 countries, with a distribution channel exceeding 17,000 partners. The actual percentage of customers still running GMS 9.5.2 or earlier is not quantified in available sources.

Migration to NSM is not technically an upgrade; it is a different product with distinct architecture, licensing, and operational requirements. The cost of transition — in planning, staff training, network policy redesign, and new license investment — falls on the customer.

SonicWall in Attackers' Crosshairs

The decision not to patch arrives at a moment of heightened exposure for SonicWall. According to BleepingComputer, the Cybersecurity and Infrastructure Security Agency (CISA) has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities (KEV) list over the past four years. Of those, 13 have been used in ransomware operations.

The Hacker News reports a specific data point: CVE-2026-102255, an SSRF vulnerability with CVSS 10.0 in the SMA1000 product, has been under active exploitation since October 2026. Researchers detected 2,541 exploitation attempts from 8 unique IP addresses, originating between Singapore and the United States. This episode, involving a different product from the same vendor, documents that threat actors monitor SonicWall attack surfaces.

No confirmation emerges from available sources that the two GMS CVEs are already under active exploitation.

What to Do Now

For organizations using SonicWall GMS 9.5.2 or earlier, the options documented in primary sources are limited. SonicWall explicitly recommends upgrading to Network Security Manager (NSM). The source does not specify detailed migration procedures or timelines.

Choosing to keep GMS in production exposes organizations to documented risks: the pre-authentication CVSS 9.1 vulnerability is particularly critical because it requires no valid credentials. Sources do not indicate workarounds or alternative temporary mitigations beyond migration.

For organizations in the planning phase, the source does not specify costs, training, or functional gaps between GMS and NSM. These elements fall within each organization's internal operational assessment.

Market Context and Transition Limits

The forced migration to NSM raises operational questions that primary sources do not explore. It is not documented whether NSM offers functional parity with GMS across all legacy use cases, nor whether SonicWall plans facilitated transition programs. The absence of these details in available sources leaves customers to handle contractual and technical verification.

The phenomenon of security products abandoned while still in production is recurring in the industry. CISA has documented numerous cases of end-of-life vulnerabilities exploited in enterprise environments, where replacement of core systems requires extended budget cycles. The SonicWall GMS case fits this structural pattern, with the peculiarity that the vendor explicitly stated the unavailability of patches rather than leaving ambiguity about the support timeline.

Sources

• thehackernews.com
• bleepingcomputer.com
• socradar.io
• nvd.nist.gov
• nvd.nist.gov
• prsol.cc