Sonic Wall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
Summary: SonicWall warned of two vulnerabilities affecting its end-of-life Global Management System (GMS) 9.5.2 and earlier versions and said no remediation or security update will be released because the product has reached end-of-life. The alert follows by less than a month SonicWall's fixes for CVE-2026-102255, a CVSS 10.0 pre-authenticated SSRF flaw that Previdian telemetry shows drew 2,541 attack attempts from eight unique IP addresses in Singapore and the U.S. since October 9, 2026, including 30 on November 3, 2026.
What's compelling: SonicWall's answer to flaws in GMS is to tell customers to migrate to Network Security Manager, leaving anyone still running 9.5.2 or earlier with no patch path. The prior SSRF flaw in the same product line already drew 2,541 exploitation attempts from eight IP addresses, so an unpatched GMS is a standing target rather than a theoretical one.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-102255
- Related