SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records Ravie LakshmananNov 04, 2026Vulnerability / Enterprise Security SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below - CVE-2026-109593 (CVSS score: 9.1) - An unauthenticated file read vulnerability that could allow an attacker with network access to read internal GMS files, potentially exposing sensitive information. CVE-2026-109594 (CVSS score: 6.8) - A post-authentication SQL injection vulnerability that could allow an authenticated attacker to access or modify information stored in the GMS database under specific conditions. "The affected product has reached End-of-life (EoL)," SonicWall said in a Tuesday alert. "As a result, no remediation or security update will be released for these vulnerabilities. Organizations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM)." The development comes less than a month after SonicWall shipped fixes for CVE-2026-102255 (CVSS score: 10.0), a critical pre-authenticated server-side request forgery (SSRF) flaw that could have allowed an attacker to reach internal functionality and perform unauthorized operations. The vulnerability has since come under active exploitation in the wild, with telemetry data from Previdian recording 2,541 attack attempts from eight unique IP addresses from Singapore and the U.S. since October 9, 2026. As many as 30 exploitation attempts were registered on November 3, 2026. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. enterprise security, network security, Vulnerability Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software AI-Generated Fake Login Pages Are Making Account Takeovers Easier PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Attend Live Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Attack Surface Is Growing Faster Than Your Team Can Respond Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security