SonicWall GMS Flaws: Unpatched Forever and Already Botnet-Bait

Another week, another vendor politely shrugging at its own install base. SonicWall has confirmed two vulnerabilities in its Global Management System — CVE-2026-109593 (CVSS 9.1, an unauthenticated file read) and CVE-2026-109594 (CVSS 6.8, a post-authentication SQL injection) — and because GMS 9.5.2 and earlier have reached end-of-life, neither will ever be fixed. The official advice is to migrate to Network Security Manager. The unofficial reality: every internet-exposed SonicWall GMS box just became a permanent part of the global attack surface. And if history is any guide, the people reading this advisory most carefully are not the defenders.

What SonicWall Is Leaving on the Table

The file read is the juicy one. Any attacker with network access to a vulnerable GMS instance can pull internal files off the box — configuration exports, credentials, session data — without ever logging in. The SQL injection requires authentication, but pair it with credentials leaked through the first bug (or with default passwords, the eternal classic of appliance security) and an attacker can read and modify GMS database records at will. A 9.1 and a 6.8, chained together, are effectively a full compromise of the management plane.

Context makes this worse. Less than a month earlier, SonicWall patched CVE-2026-102255, a perfect-10 pre-authentication SSRF that is already under active exploitation, with thousands of attack attempts recorded since early October. Threat actors clearly treat SonicWall advisories as release notes. An advisory that says "no fix is coming" is, for them, an open invitation with no expiry date.

EoL Appliances Are Botnet Recruitment Material

We've seen this movie before — Mirai built an empire on unpatchable boxes, and every major botnet since has fed on the same diet. An end-of-life management appliance with a 9.1 unauthenticated flaw is close to ideal prey: it sits on a fat enterprise pipe, runs 24/7, is rarely monitored, and will never be patched. Expect Shodan and Censys queries for GMS fingerprints within days, working exploits within weeks, and these devices quietly enlisting in someone's DDoS fleet — spewing UDP flood and HTTP flood traffic on behalf of every booter and ip stresser customer willing to pay a few dollars. The ddos-for-hire economy runs on exactly this kind of free, vendor-abandoned inventory. One forgotten SonicWall GMS server on a gigabit uplink can push more layer 7 traffic than a hundred compromised home routers.

What You Should Actually Do

• Migrate to NSM. Yes, migrations are painful. So is explaining why your management box ended up in someone's botnet.
• Never expose management interfaces. GMS, NSM, firewalls, routers — none of them belong on the public internet. Restrict by ACL or VPN, today.
• Assume compromise and audit. If your GMS was reachable, review logs and file access patterns going back weeks, not days.
• Validate your ddos protection. Don't assume your scrubbing, anycast or cloudflare bypass resistance works — prove it with regular stress testing, including layer 7 scenarios.

The Bottom Line

SonicWall GMS joins the long list of products that will be exploited forever, because "end of life" for a vendor never means end of life for the internet. Unpatched edge appliances are the raw material of every record-breaking attack we've covered on our blog. If you'd rather know than guess whether your infrastructure survives the firepower these freshly recruited botnets deliver, request our free stress test — we'll show you exactly where your defenses bend before someone less friendly does.