SonicWall has issued a warning regarding two significant vulnerabilities affecting its outdated Global Management System (GMS), which will remain unpatched. These vulnerabilities are found in versions 9.5.2 and older, posing serious security concerns for organizations still utilizing these systems.
Unpatched Vulnerabilities Detailed
The first vulnerability, identified as CVE-2026-109593, has been assigned a CVSS score of 9.1. It allows an unauthenticated attacker with network access to read internal files, risking exposure of sensitive data. The second, CVE-2026-109594, with a CVSS score of 6.8, is a post-authentication SQL injection flaw. This could enable a verified attacker to access or alter database records under certain conditions.
SonicWall has clarified that these vulnerabilities will not receive any updates or patches due to the product reaching its end-of-life (EoL) status. Organizations employing this software are advised to consider the associated risks seriously.
Recommendations for Affected Organizations
In response to these unpatched flaws, SonicWall strongly recommends that organizations transition to the SonicWall Network Security Manager (NSM). This move is encouraged to mitigate potential security threats and ensure more robust protection against unauthorized access or data manipulation.
The advisory follows closely on the heels of SonicWall’s recent patch for a critical vulnerability, CVE-2026-102255, which had a perfect CVSS score of 10.0. This earlier flaw involved a server-side request forgery attack, which could be exploited without authentication.
Active Exploitation and Recent Developments
Since its disclosure, CVE-2026-102255 has been actively exploited. Data from Previdian highlights 2,541 attack attempts originating from eight distinct IP addresses in Singapore and the U.S. from October 9, 2026, onwards. Notably, 30 attempts were recorded on November 3, 2026, underscoring the urgency for organizations to address these vulnerabilities.
As cyber threats evolve, maintaining updated security systems is critical. Organizations using SonicWall’s EoL products must weigh the risks of continued usage against the benefits of upgrading to more secure solutions.
In conclusion, while SonicWall’s decision not to patch these vulnerabilities in its GMS product poses challenges, it emphasizes the importance of proactive security measures and timely upgrades to safeguard organizational data and operations.
