Ethical Hacking News
SonicWall has failed to patch two significant vulnerabilities in its end-of-life Global Management System products, leaving organizations exposed to security risks. The company has advised its customers to upgrade to the SonicWall Network Security Manager (NSM) to mitigate the risks associated with these vulnerabilities.
SonicWall has failed to patch vulnerabilities in its end-of-life Global Management System (GMS) products. Two significant security flaws were discovered in the affected products, including an unauthenticated file read vulnerability (CVE-2026-109593) with a CVSS score of 9.1. A post-authentication SQL injection vulnerability (CVE-2026-109594) with a CVSS score of 6.8 was also discovered. The company has advised organizations to upgrade to the SonicWall Network Security Manager (NSM) to mitigate the risks. This decision highlights the importance of responsible security practices and the need for companies to prioritize the security of their products.
SonicWall, a leading provider of network security solutions, has recently been criticized for its failure to patch vulnerabilities in its end-of-life Global Management System (GMS) products. The company has warned of two significant security flaws in the affected products, which are no longer receiving updates or support.
The first vulnerability, identified as CVE-2026-109593, is an unauthenticated file read vulnerability that could allow an attacker with network access to read internal GMS files, potentially exposing sensitive information. This vulnerability has been rated with a CVSS score of 9.1, indicating its potential severity.
The second vulnerability, identified as CVE-2026-109594, is a post-authentication SQL injection vulnerability that could allow an authenticated attacker to access or modify information stored in the GMS database under specific conditions. This vulnerability has been rated with a CVSS score of 6.8.
SonicWall has stated that the affected products have reached the end-of-life (EoL) stage, and as a result, no remediation or security update will be released for these vulnerabilities. The company has advised organizations that use the affected products to be aware of the associated security risks and to upgrade to the SonicWall Network Security Manager (NSM) as soon as possible.
This decision not to patch the vulnerabilities has raised concerns among cybersecurity experts, who have warned that the lack of support for these products could leave organizations vulnerable to attack. The fact that the vulnerabilities were not patched in a timely manner is particularly concerning, given the potential severity of the first vulnerability.
It is worth noting that this is not the first time SonicWall has faced criticism for its patching practices. The company recently faced backlash for its failure to patch a critical vulnerability in its SonicWall GMS 9.5.2 product, which was identified as CVE-2026-102255. This vulnerability was later found to be actively exploited in the wild, with telemetry data from Previdian recording 2,541 attack attempts from eight unique IP addresses.
The lack of timely patching by SonicWall highlights the importance of responsible security practices and the need for companies to prioritize the security of their products. As organizations continue to rely on outdated technology, the risk of security breaches and vulnerabilities increases. It is essential for companies like SonicWall to take proactive steps to address these issues and provide their customers with timely and effective security patches.
In conclusion, SonicWall's decision not to patch the vulnerabilities in its end-of-life Global Management System products has raised significant concerns among cybersecurity experts and organizations. The company's failure to address these vulnerabilities in a timely manner has left organizations vulnerable to attack, and it is essential for companies like SonicWall to prioritize the security of their products.
Related Information:
https://www.ethicalhackingnews.com/articles/SonicWall-Fails-to-Patch-Vulnerabilities-in-End-of-Life-Global-Management-System-Exposing-Organizations-to-Security-Risks-ehn.shtml
https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html
https://nvd.nist.gov/vuln/detail/CVE-2026-109593
https://www.cvedetails.com/cve/CVE-2026-109593/
https://nvd.nist.gov/vuln/detail/CVE-2026-109594
https://www.cvedetails.com/cve/CVE-2026-109594/
https://nvd.nist.gov/vuln/detail/CVE-2026-102255
https://www.cvedetails.com/cve/CVE-2026-102255/
Published: Wed Nov 4 12:47:59 2026 by llama3.2 3B Q4_K_M
