SonicWall has issued a security advisory regarding two significant vulnerabilities impacting its Global Management System (GMS) software. These flaws specifically affect GMS version 9.5.2 and all previous versions. Because these versions have reached their end of life status, the manufacturer has confirmed that it will not be releasing security updates or patches to mitigate the risks.

The most severe of the identified issues is CVE-2026-109593, which carries a CVSS score of 9.1. This vulnerability represents an unauthenticated file read risk, which could allow an unauthorized attacker with network access to gain access to and read internal GMS files. Such exposure could compromise sensitive system information and configurations.

A second vulnerability exists that could potentially allow for the alteration of database records. SonicWall recommends that any organizations still running these legacy versions transition to supported hardware or software versions to ensure continued protection. The lack of patching means that systems remaining on version 9.5.2 or earlier will remain permanently exposed to these specific attack vectors unless they are decommissioned or isolated.

For IT directors and operations leaders, this development highlights the critical risks associated with running legacy infrastructure beyond its support lifecycle. Maintaining an accurate inventory of management software versions is essential for preventing unpatched vulnerabilities from becoming entry points for network intrusion.

The BroadVision view

Organizations using legacy management tools must prioritize lifecycle management to avoid security gaps left by discontinued vendor support. Assessing the risk of unpatched systems is a vital step in maintaining a resilient security posture. Teams should evaluate their current environments through strategic IT services to identify and replace high risk end of life assets.