SonicWall Will Not Patch Critical EoL GMS Flaws Exposing Files

SonicWall has issued a warning regarding two security vulnerabilities impacting end-of-life Global Management System (GMS) installations. The company explicitly stated that patches for these issues will not be developed or released.

• CVE-2026-109593 carries a critical CVSS score of 9.1
• The flaws impact SonicWall GMS version 9.5.2 and all earlier releases
• Unauthenticated attackers with network access can read internal system files

Understanding the Vulnerability Risks

The primary security flaw, tracked as CVE-2026-109593, has been assigned a critical CVSS severity score of 9.1. It is classified as an unauthenticated file read vulnerability affecting legacy GMS deployments.

An attacker with network access could exploit this flaw to read sensitive internal GMS files and potentially alter database records, posing a severe risk to organizational networks running unsupported software.

Mitigation and Recommendations

Since SonicWall has confirmed that end-of-life GMS versions will not receive patches, organizations must migrate to currently supported software versions to eliminate potential security exposures and protect their infrastructure.