SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records

SonicWall has disclosed two unpatched security vulnerabilities impacting end-of-life Global Management System (GMS) versions 9.5.2 and earlier. The flaws include CVE-2026-109593, a critical unauthenticated file read vulnerability rated CVSS 9.1 that allows attackers with network access to inspect internal system files. The announcement follows active in-the-wild exploitation of CVE-2026-102255, a pre-authenticated server-side request forgery flaw with a CVSS score of 10.0.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's port module detects exposed SonicWall GMS administration interfaces on public network ports and identifies vulnerable, end-of-life software versions (9.5.2 and earlier) by inspecting HTTP banners and service signatures.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain