SonicWall Leaves EoL GMS Exposed to CVSS 9.1 File Read and SQLi Flaws Without Patches

SonicWall disclosed the two vulnerabilities on 4 November 2026 and immediately classified the affected GMS versions as end-of-life, stating no remediation will be provided. CVE-2026-109593 permits unauthenticated network attackers to read internal files while CVE-2026-109594 allows authenticated database modification. The vendor directs customers to migrate to Network Security Manager without offering interim controls or extended support timelines.

Telemetry published by Previdian shows 2541 exploitation attempts against the recently patched CVE-2026-102255 SSRF from eight IPs since 9 October 2026, with daily peaks reaching 30 attempts. The same exposure surface remains open in unpatched EoL deployments that cannot receive equivalent fixes. Procurement records indicate multiple government and enterprise contracts still list GMS 9.x instances under active maintenance windows that end without security updates.

This pattern repeats across vendors that terminate support while devices remain internet-reachable. Contract language rarely obligates disclosure of residual risk or coordinated vulnerability handling after EoL, creating persistent blind spots that defenders cannot close through patching. The absence of responsible disclosure timelines for EoL products converts known high-severity issues into long-term operational liabilities rather than transient bugs.

Organizations retaining GMS instances face an expanding attack window measured in years rather than days. Migration audits and network segmentation become the only remaining controls, yet telemetry from prior EoL abandonments shows migration rates below 40 percent within the first six months after announcement.