Unpatched SonicWall EoL GMS Flaws Pose Persistent Risk
SonicWall has issued a warning regarding two unpatched vulnerabilities impacting its end-of-life (EoL) Global Management System (GMS) software. Specifically, these security flaws affect SonicWall GMS 9.5.2 and all earlier versions. The vendor has explicitly stated that no security updates or remediation will be released for these vulnerabilities due to the product’s EoL status. Organizations continuing to use these systems face inherent security risks, including the potential for unauthorized file exposure and alteration of database records, as reported by The Hacker News.
Technical Details of SonicWall GMS 9.5.2 End-of-Life Vulnerabilities
The vulnerabilities identified in SonicWall GMS 9.5.2 and prior versions are significant because they allow for unauthorized access to sensitive data and system integrity compromises. While the specific technical details of these two new GMS flaws, such as their type or attack vectors, were not fully disclosed in the advisory, the stated impact—exposure of files and alteration of database records—indicates a high potential for data breaches and system corruption. Crucially, because these systems have reached EoL, they will remain permanently vulnerable to these issues.
This development occurs shortly after SonicWall addressed a separate, critical vulnerability, CVE-2026-102255, a pre-authenticated Server-Side Request Forgery (SSRF) flaw with a CVSS score of 10.0. This SSRF vulnerability allowed attackers to access internal functionality and perform unauthorized operations. Unlike the GMS flaws, CVE-2026-102255 has been actively exploited in the wild, with telemetry data indicating over 2,500 attack attempts from various IP addresses. While CVE-2026-102255 pertains to different SonicWall products and has received patches, its active exploitation underscores the critical importance of promptly addressing severe vulnerabilities across all enterprise systems. The EoL GMS flaws, though not yet reported as actively exploited, present a similar level of inherent risk for any organization that has not transitioned away from the unsupported platform.
Continuing to operate software beyond its end-of-life date, especially when known vulnerabilities are present and unpatchable, creates a substantial attack surface. Threat actors frequently scan for and target EoL products, knowing they will not receive further security updates. This makes SonicWall GMS 9.5.2 end-of-life vulnerabilities a persistent concern for any organization that has not yet decommissioned or upgraded these systems.
Mitigating Unpatched SonicWall GMS Flaws
For organizations still utilizing SonicWall GMS 9.5.2 and earlier, the most imperative action is an immediate upgrade to the SonicWall Network Security Manager (NSM). This transition ensures access to supported software, ongoing security updates, and vendor-provided remediation for future vulnerabilities. Given the unpatchable nature of the current GMS flaws, continued use represents an unacceptable risk posture.
For environments where immediate migration is not feasible, although strongly discouraged, organizations must implement stringent compensatory controls:
- Network Segmentation: Isolate EoL GMS systems on highly restricted network segments, limiting all inbound and outbound traffic to only essential services and trusted sources.
- Access Control: Enforce strict access controls, utilizing multi-factor authentication (MFA) and least privilege principles for any users or services interacting with the EoL GMS instance.
- Continuous Monitoring: Implement comprehensive logging and monitoring solutions to detect any suspicious activity, unauthorized access attempts, or anomalous behavior originating from or targeting the EoL GMS systems. This includes monitoring for indicators of compromise related to potential file exposure or database manipulation.
- Web Application Firewall (WAF): Deploy a WAF in front of any exposed GMS interfaces to filter malicious traffic and potentially block exploitation attempts, though this offers only partial protection against sophisticated attacks.
Organizations must also prioritize their vulnerability management strategies to include regular audits of all network assets, identifying and decommissioning EoL software. This proactive approach is essential for preventing threat actors from leveraging CVE-2026-102255 SSRF exploit detection techniques or similar methods against other vulnerable, but supported, systems. Proactive identification and deprecation of unsupported software are fundamental steps in reducing the overall attack surface and minimizing exposure to known, unpatchable risks.
Related: CVE-2026-83548: SonicWall SMA1000 SSRF Under Active Exploitation, SonicWall SMA 1000 SSRF Under Active Attack