SonicWall issued an urgent warning to its customers regarding the discovery of two security vulnerabilities in the Global Management System (GMS), pointing out that these vulnerabilities will not be fixed through any future software updates. This action comes due to the GMS system reaching the "End-of-Life" stage, which means technical support and security updates for it have officially ceased.
Details of the Discovered Vulnerabilities
The two vulnerabilities were identified by security researchers at Pentest-Tools, and they affect GMS version 9.5.2 and earlier versions. The risks are as follows:
- The first vulnerability (CVE-2026-109593): Allows unauthorized attackers with network access to read internal system files and steal sensitive information.
- The second vulnerability (CVE-2026-109594): Allows highly privileged attackers to access the GMS system database or modify information stored within it, through low-complexity SQL Injection attacks.
Why does this news pose a real danger?
The danger lies in the fact that organizations still relying on the GMS system to manage their security devices find themselves facing "open vulnerabilities" without software solutions. Usually, companies release patches immediately upon discovering vulnerabilities, but the EOL status means the only available solution is a complete upgrade to the alternative platform, which is Network Security Manager (NSM). Any delay in the migration process leaves the organization's infrastructure vulnerable to direct compromise via known and documented vulnerabilities.
An increasingly challenging security context
This warning comes at a time when SonicWall faces mounting security pressures; data from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) indicates that 19 of the company's vulnerabilities have been actively exploited, including 13 vulnerabilities used by ransomware gangs. The company has witnessed a series of zero-day attacks over the past months, making the retirement of legacy and unsupported systems a top priority to avoid targeting digital infrastructure.