SonicWall says it will not patch critical GMS flaws, tells users to move to NSM
SonicWall disclosed a 9.1-rated unauthenticated file-read flaw and a 6.8-rated SQL injection flaw in GMS 9.5.2 and earlier on November 3rd.
By Ryan Merket · Published
Primary source: psirt.global.sonicwall.com
Why it matters
A management console that can be read without a login gives attackers a direct path to firewall configuration and tenant data. SonicWall has closed the usual remediation route by refusing to patch end-of-life GMS, so every remaining operator has to isolate the system or complete the NSM migration that the vendor had already been pushing.
SonicWall will not patch two vulnerabilities in its end-of-life Global Management System, including a critical unauthenticated file-read flaw rated 9.1, and is telling customers still running the software to move to Network Security Manager instead.
The disclosure came in advisory SNWLID-2026-0019, first published on November 3rd, 2026. SonicWall said the flaws affect GMS 9.5.2 and earlier versions on the Virtual Appliance and Windows editions. The advisory lists no workaround and no fixed version.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.