[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLCdj8aqsyEBWegZJQh_ulm1vJWVXmeHV_1Uf6hABv1Y":3},{"article":4,"iocs":43,"watch_terms":51,"solutions":52,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"d985ae50-7941-4e9c-bfb5-2571e490ae84","SonicWall warns of unpatched flaws in end-of-life GMS software","sonicwall-warns-of-unpatched-flaws-in-end-of-life-gms-software-803d0b","SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched. [...]","SonicWall has alerted customers to two critical security flaws in its end-of-life Global Management System (GMS) software, versions 9.5.2 and earlier. These vulnerabilities, CVE-2026-109593 and CVE-2026-109594, allow unauthenticated attackers to steal sensitive information or conduct SQL injection attacks. As GMS is no longer supported, SonicWall will not release patches and strongly advises users to migrate to the newer Network Security Manager (NSM) platform.","SonicWall warns of two unpatched vulnerabilities in end-of-life GMS software.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fsonicwall-warns-of-unpatched-flaws-in-end-of-life-gms-software\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F04\u002FSonicWall.jpg","2026-11-04T14:42:25+00:00","2026-11-04T15:00:30.996074+00:00",8,[17,20,23],{"name":18,"type":19},"Global Management System (GMS)","product",{"name":21,"type":22},"SonicWall","vendor",{"name":24,"type":19},"Network Security Manager (NSM)","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48],{"type":45,"value":46,"context":47},"cve","CVE-2026-109593","Information disclosure vulnerability in SonicWall GMS",{"type":45,"value":49,"context":50},"CVE-2026-109594","SQL injection vulnerability in SonicWall GMS",[21,18,24],{"controls":53,"vendors":133},[54,83,108],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":84,"product_name":105,"url":106,"description":107},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":109,"name":110,"problem":111,"products":112},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[113,120,125],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":115,"url":118,"description":119},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":121,"product_name":122,"url":123,"description":124},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",[134],{"slug":135,"name":21,"logo_path":136,"roles":137},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[138],"affected",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"sonicwall-end-of-life-gms-flaws-leave-users-exposed-with-no-patch-coming","SonicWall End-of-Life GMS Flaws Leave Users Exposed with No Patch Coming","SonicWall's Global Management System (GMS) versions 9.5.2 and earlier contain two critical unpatched vulnerabilities that allow unauthenticated attackers to steal sensitive data or perform SQL injection attacks. Because the software has reached end-of-life, SonicWall will not issue patches, leaving any organization still running GMS permanently exposed. This incident highlights the severe risk of continuing to operate unsupported software in production environments, particularly network management platforms that hold privileged credentials and configuration data. Organizations must treat end-of-life software as a critical vulnerability in its own right and have migration timelines well before vendor support ends.",[144,145,146,147,148,149,150],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":152,"PCI DSS Requirement 6":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"OWASP A06:2021 Vulnerable and Outdated Components":155,"CIS Control 7: Continuous Vulnerability Management":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"NIS2 mandates that essential and important entities handle vulnerabilities through appropriate technical measures, which includes planning for and executing migrations away from unsupported software that cannot be patched.","PCI DSS Requirement 6 mandates that all system components are protected from known vulnerabilities by installing applicable security patches; end-of-life software with no available patch is non-compliant by definition and must be replaced.","SI-2 requires organizations to identify, report, and correct information system flaws, and to replace software when vendor remediation is no longer available, directly addressing the obligation to migrate off unsupported GMS.","GMS 9.5.2 is a textbook example of an outdated, unsupported component; OWASP A06 explicitly warns that using software without security patches or past its support life introduces exactly this class of critical risk.","A continuous vulnerability management program would have flagged GMS as end-of-life and critically exposed, triggering a mandatory migration before these CVEs were disclosed.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, including replacing software for which no patch can be obtained from the vendor.","The CVEs allow unauthenticated access to a privileged network management platform; enforcing authentication controls and limiting exposure of management interfaces would have reduced the attack surface while migration was underway."]