Thehackernews SonicWall GMS Vulnerabilities Remain Unpatched After EOL Announcement
Article Content
- •Two critical vulnerabilities in SonicWall GMS will not be patched due to EOL status.
- •CVE-2026-109593 allows unauthenticated file access; CVE-2026-109594 enables SQL injection.
- •SonicWall urges users to upgrade to the Network Security Manager to mitigate risks.
SonicWall has disclosed two critical vulnerabilities in its end-of-life Global Management System (GMS) software, specifically versions 9.5.2 and earlier. The vulnerabilities, CVE-2026-109593 and CVE-2026-109594, allow unauthenticated attackers to read sensitive internal files and authenticated attackers to perform SQL injection attacks, respectively. SonicWall confirmed that it will not issue patches for these flaws due to the product's end-of-life status. Organizations using GMS are urged to migrate to the newer Network Security Manager (NSM) platform. The first vulnerability has a CVSS score of 9.1, indicating critical severity, while the second has a score of 6.8. This announcement comes amid ongoing exploitation of other SonicWall vulnerabilities, with CISA listing multiple SonicWall flaws as actively exploited. SonicWall serves over 500,000 customers globally, raising concerns about the security risks posed by these unpatched vulnerabilities.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (7)
Following this threat?
Track Sonicwall and CVE-2026-102255 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What are the CVEs associated with these vulnerabilities?
What should organizations using GMS do?
Is there any patch available for these vulnerabilities?
Continue Reading
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in the Wild On October 13, 2026, Ivanti disclosed a high-severity zero-day vulnerability tracked as CVE-2026-104935, affecting its Connect Secure (ICS) VPN appliances. This authentication bypass flaw allows unauthenticated attackers to execute arbitrary commands, with exploitation confirmed since at least October 1. The… 
Atlassian Flaw Exploited Within Hours of Disclosure A vulnerability in Atlassian Data Center products, tracked as CVE-2026-21589 with a CVSS score of 9.3, was within two hours of its disclosure. The flaw allows arbitrary file access and affects multiple products, including Bitbucket, Confluence, and Jira. Exploitation activity targeting honeypot networks began…