SonicWall Will Not Patch Two Flaws in Retired GMS Product, Urges Customers to Upgrade

SonicWall has warned of two security vulnerabilities affecting its Global Management System (GMS), versions 9.5.2 and earlier. The product has reached end-of-life, so the company says no remediation or security update will be released. In a Tuesday alert, SonicWall said organisations still using GMS should be aware of the associated risks and strongly encouraged them to upgrade to its Network Security Manager (NSM).

The announcement comes less than a month after SonicWall released fixes for a separate, critical flaw tracked as CVE-2026-102255, which carries the maximum severity score of 10.0. It is a pre-authenticated server-side request forgery (SSRF) issue that could let an attacker reach internal functionality and perform unauthorised operations without logging in.

That earlier flaw is already being exploited in the wild. Telemetry from Previdian recorded 2,541 attack attempts from eight unique IP addresses in Singapore and the United States since 9 October 2026, with as many as 30 attempts logged on 3 November 2026. This article is based on the opening section of the source report, so it does not cover every detail of the two unpatched GMS flaws.

For businesses, the lesson is that retired software does not simply sit quietly. Once a vendor stops issuing fixes, any weakness found later stays open permanently.