Skip to content
securitytabs

LiveUpdated

SonicWall says it will not patch two flaws in end-of-life GMS software

SonicWall has warned that its retired Global Management System, a tool for managing SonicWall firewalls, has two security flaws that will never be fixed. Organizations still running it should plan to replace or isolate it.

SonicWall will not fix flaws in retired GMS software
SonicWall will not fix flaws in retired GMS software

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

SonicWall warned customers of two vulnerabilities in its Global Management System (GMS), software that has reached end of life. The company said it will not release patches for them. [1][2]

The flaws affect GMS 9.5.2 and earlier versions. One, CVE-2026-109593, has a CVSS score of 9.1 and is an unauthenticated file read: an attacker with network access could read internal GMS files. The other could allow database records to be altered, according to The Hacker News headline. [2]

Exploitation and what is not yet known

The available coverage does not report any exploitation of the flaws. It also does not describe workarounds beyond SonicWall's statement that no patch will come. [1][2][3]

Timeline

  1. SonicWall's decision not to fix the GMS flaws was still being reported alongside other vendors' patches. [3]

  2. SonicWall said GMS 9.5.2 and earlier versions are affected and will not be patched. [2]

  3. SonicWall warned customers of two unpatched flaws in end-of-life GMS software. [1][2]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Businesses that still run SonicWall GMS 9.5.2 or earlier will not receive fixes for these flaws. [2]

What to do

  1. Ask your IT provider whether any SonicWall GMS installation is still in use. [1]
  2. Ask your provider about SonicWall's guidance for customers running the retired software. [1][2]

Mid-size company

A small IT or security team

What to know

SonicWall says the end-of-life GMS flaws will stay unpatched, and the sources publish no mitigation. [1][2]

What to do

  1. Identify any GMS 9.5.2 or earlier systems in your asset inventory. [2]
  2. Watch SonicWall's advisories for any guidance on replacement or mitigation. [1]

Large enterprise

A security operations team

What to know

Affected GMS versions allow unauthenticated file reads by an attacker with network access, and no fix is planned. [2]

What to do

  1. Inventory GMS deployments at scale and review which networks can reach them. [2]
  2. Monitor SonicWall's advisories for further guidance, since the sources publish no workaround. [1][3]

Sources

  1. [1]BleepingComputer · Nov 4, 14:42 UTC
    SonicWall warns of unpatched flaws in end-of-life GMS softwarecontext
  2. [2]The Hacker News · Nov 4, 17:00 UTC
    SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Recordscontext
  3. [3]SecurityWeek · Nov 5, 12:33 UTC
    Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flawscontext