SonicWall's Unpatched Flaws: What You Need to Know

Michael Miller · 2026-11-04

SonicWall recently dropped some news that's making security teams scratch their heads. They've identified two vulnerabilities in their end-of-life Global Management System (GMS) – and they're not going to patch them. If you're still running GMS 9.5.2 or earlier, this one's for you. ### The Flaws: What's the Deal? The first vulnerability, CVE-2026-109593, has a CVSS score of 9.1 – that's critical, folks. It's an unauthenticated file read vulnerability. In plain English: if someone can reach your GMS system over the network, they could read internal files without needing any credentials. Think of it like leaving a window unlocked in a back room – anyone who knows it's there can slip in and take a look around. SonicWall hasn't disclosed the second flaw yet, but they've confirmed it exists and won't be fixed. Both affect GMS 9.5.2 and earlier versions. ### Why No Patch? Here's the rub: GMS is end-of-life. That means SonicWall has officially stopped supporting it. No more updates, no more patches. They're essentially saying, "We've moved on, and you should too." It's a tough pill to swallow if you're one of the many organizations still relying on GMS for centralized management of your SonicWall firewalls. ### What Should You Do? If you're still on GMS, you're in a tight spot. Here are your options: - **Upgrade to a supported platform.** SonicWall offers newer management solutions like NSM (Network Security Manager) that are actively maintained. Yes, it's a migration headache, but it's better than leaving a gaping security hole. - **Isolate the GMS system.** If you can't migrate immediately, limit network access to GMS as much as possible. Put it behind a firewall, restrict who can reach it, and monitor it like a hawk. - **Consider third-party management tools.** Some organizations use alternative management platforms that can handle SonicWall devices. Do your research and make sure they're secure. - **Stay informed.** Keep an eye on SonicWall's advisories and security news. Even if they won't patch, they might offer mitigation advice. > "The cost of ignoring end-of-life systems is often much higher than the cost of upgrading. Don't wait for a breach to force your hand." ### The Bigger Picture This isn't just about SonicWall. It's a reminder that end-of-life software is a ticking time bomb. Vendors eventually stop supporting old products, and when they do, you're on your own. The smart move is to plan your migrations before you're forced into a corner. For now, if you're running GMS 9.5.2 or earlier, treat it as a compromised asset. Assume attackers know about these flaws (they probably do), and act accordingly. Your network's security depends on it.