In a report by Bleeping Computer, SonicWall has issued a warning regarding two critical security vulnerabilities affecting its Global Management System, or GMS, which has reached its end-of-life status.
The vulnerabilities, identified as CVE-2026-109593 and CVE-2026-109594, impact systems running GMS 9.5.2 and earlier versions. The first flaw allows unauthenticated attackers with network access to steal sensitive information by reading internal files. The second issue involves a SQL injection vulnerability that permits attackers with high privileges to modify or access database information. Because the product is no longer supported, SonicWall confirmed it will not release security patches for these flaws. The company strongly urges organizations to migrate to the Network Security Manager platform to mitigate risks. SonicWall products have frequently been targeted by threat actors, with the Cybersecurity and Infrastructure Security Agency adding 19 of the company's vulnerabilities to its list of actively exploited flaws over the last four years. Given that SonicWall serves over 500,000 customers globally, including government agencies and large enterprises, the lack of remediation for these end-of-life systems presents a significant security concern for IT administrators managing these legacy environments.
Source: Bleeping Computer
