SonicWall will not fix two serious flaws in old management software

SonicWall has warned that two security flaws in its Global Management System, known as GMS, will never get a fix. The product is end-of-life, which means the company no longer supports it. Anyone still running version 9.5.2 or earlier is now stuck with the risk.

What changed

In a Tuesday alert, SonicWall said no remediation or security update will be released. It strongly encourages affected organizations to move to its Network Security Manager. One flaw, CVE-2026-109593, is rated 9.1 out of 10 for severity. It lets an attacker read files without logging in. The details of the second flaw were not included in the material available, though the story title says the flaws could also alter database records.

A separate flaw is under attack

Less than a month ago, SonicWall fixed a different flaw, CVE-2026-102255, rated a perfect 10.0. It could let an attacker trick a server into reaching internal functions and doing things they should not be allowed to do. Attackers are already using it. Telemetry from Previdian recorded 2,541 attempts from eight unique IP addresses in Singapore and the U.S. since October 9, 2026. On November 3 alone, there were as many as 30.

Who it affects

The risk falls on organizations running GMS 9.5.2 or earlier, and on the IT teams or providers that manage it for them. If you do not use this product, the GMS warning does not apply to you. It is not stated whether the two GMS flaws are being attacked yet.

What to do

The alert box above lists the steps. The short version: find out whether you run this software, plan the move to a supported product, and keep your other SonicWall devices updated.