SonicWall has disclosed two vulnerabilities affecting its end-of-life Global Management System (GMS) product and said the issues will not be patched. According to the company, the flaws affect SonicWall GMS 9.5.2 and earlier versions. One of the disclosed issues, tracked as CVE-2026-109593, carries a CVSS severity score of 9.1 and could allow an unauthenticated attacker with network access to read internal GMS files.

For businesses still using older GMS deployments, the announcement is a practical reminder of the security and operational risks tied to unsupported infrastructure. When a vendor confirms that a product has reached end of life and will not receive security fixes, organisations may need to rely on containment, migration and access controls rather than patching.

What happened

SonicWall published a security warning covering two vulnerabilities in end-of-life GMS systems. The affected versions are reported as GMS 9.5.2 and earlier. The company said it will not release patches for these issues because the product versions are no longer supported.

The source information specifically identifies CVE-2026-109593 as an unauthenticated file read vulnerability. In practical terms, that means an attacker with network access to the vulnerable system may be able to access internal files without logging in. The source also notes a second vulnerability affecting the same product line, although the available source text does not provide its full technical details here.

Why it matters for European businesses

This matters less because of SonicWall alone and more because it reflects a common business risk: security-critical software that remains in production after support ends. GMS is used for centralized management, so weaknesses in such a system can create broader exposure across firewall administration, configuration workflows and security operations.

For European organisations, unsupported security management tools can create several problems:

• Security exposure: Unpatched flaws in internet-reachable or internally exposed management systems may give attackers a foothold into sensitive administrative environments.
• Operational risk: A compromise of management platforms can affect visibility, policy management and incident response processes.
• Compliance pressure: Businesses subject to GDPR, NIS2-related obligations or sector-specific security requirements may need to show that they manage known vulnerabilities and unsupported systems appropriately.
• Third-party and customer assurance: Suppliers and enterprise customers increasingly scrutinise how vendors and partners handle end-of-life software in production environments.

The main business lesson is straightforward: when a vendor confirms there will be no fix, the risk often shifts from routine patch management to urgent compensating controls and replacement planning.

Who may be affected

The immediate impact is most relevant for organisations still running SonicWall GMS 9.5.2 or earlier, especially where the system is reachable from broad internal networks or external network paths. Potentially affected groups include:

• IT and security teams managing SonicWall infrastructure through older GMS deployments
• SMEs that have kept legacy network management platforms in place beyond their official support lifecycle
• Businesses with limited internal resources for firewall platform upgrades or migration projects
• Managed service providers and digital infrastructure teams responsible for client network security environments

Companies that do not use SonicWall GMS are not directly affected by these specific flaws, but the issue is still relevant as an example of the risks around unsupported management software.

What companies should consider

Businesses using affected GMS versions should verify their exposure and review what access paths exist to the system. Because SonicWall has stated that no patch will be provided for the end-of-life product, practical next steps are likely to focus on risk reduction and migration.

• Identify affected installations: Confirm whether any GMS 9.5.2 or earlier instances remain in use, including older internal deployments that may not be part of current asset inventories.
• Restrict network access: Limit access to the management system to only necessary administrators and trusted network segments. Remove any unnecessary exposure.
• Review internet exposure: Check whether the platform is directly or indirectly reachable from the public internet and reduce that exposure where possible.
• Assess sensitive data in the platform: Determine what internal files, credentials, configurations or logs may be accessible if the system is compromised.
• Plan migration or replacement: If the product is end of life, prioritise moving to a supported alternative rather than relying on temporary controls alone.
• Document risk decisions: For regulated or security-sensitive environments, keep a clear record of exposure assessments, mitigation actions and upgrade plans.

For SMEs, the broader takeaway is to treat end-of-life infrastructure as a business continuity and governance issue, not only an IT maintenance task. Unsupported management systems can become a weak point in otherwise modern security environments.