SonicWall's Gen 6 Cliff: TZ, NSA and NSa Firewalls Lose Support on October 1, 2026 — Half of Them Already Have

By Scott Bissett  ·  Published: September 3, 2026  ·  EOL Watch — news analysis  ·  Every date verified against SonicWall's Product Life Cycle Tables (read September 3, 2026) and CISA's KEV catalog

The most widely deployed generation of SonicWall firewalls is going out of support in two waves, and the first wave has already broken. Per SonicWall's Product Life Cycle Tables, the TZ400, TZ600, NSA 3600 and NSa 3650 reached End of Support on August 1, 2026. The rest of Gen 6 — TZ350, TZ500, SOHO 250, NSA 4600, 5600 and 6600, NSa 4650, 5650 and 6650 — follows on October 1, 2026, four weeks from today. SonicWall's definition of the milestone is blunt: no technical support, no firmware updates or upgrades, no hardware replacement.

Two things make this more than a refresh cycle. First, the firmware stopped two years before the support did: for the models that left sale on April 15, 2022, Limited Retirement Mode — SonicWall's term for “we will no longer develop or release firmware updates or new features” — began on April 16, 2024. Second, the platform has a ransomware record: all three SonicOS entries in CISA's Known Exploited Vulnerabilities catalog are flagged for known ransomware use, and the two most recent carry CISA's instruction to discontinue use of the product if mitigations cannot be applied.

The verified dates

Every date below is from the dataset SonicWall publishes on its lifecycle page, which our SonicWall Firewalls page re-verifies at every build. SonicWall's phases, in order: Last Order Day, Active Retirement Mode (no longer manufactured or sold), Limited Retirement Mode (no more firmware), 1-Year Support Last Order Day, End of Support. The cells are bound to that data.

Why this platform's deadline matters more than most

SonicOS is a small entry in CISA's catalog by count and a large one by consequence: every SonicOS CVE that CISA has confirmed as exploited is also flagged for known use in ransomware campaigns. The two 2024 entries were exploited against exactly the Gen 5, Gen 6 and Gen 7 SSL-VPN configurations that this hardware runs, and from CVE-2024-40766 onward CISA's required action reads “apply mitigations per vendor instructions or discontinue use of the product.”

The pattern that matters for October 1: each of these was fixed by a firmware release on hardware that was still receiving firmware. A Gen 6 firewall past End of Support is on firmware that receives no fixes, on hardware that receives no replacement, facing an adversary that has demonstrated interest three times. CISA's Binding Operational Directive 26-02 orders federal agencies to inventory end-of-support edge devices and retire them; a TZ500 on October 1 is exactly what the directive means.

Gen 7 is already on the clock

The replacement generation is not new. SonicWall has published Last Order Days for its first Gen 7 models: October 31, 2025 for the NSa 2700 and NSa 3700, June 30, 2026 for the TZ270 and TZ470, and October 30, 2026 for the NSv 270, 470 and 870 virtual appliances. No Active Retirement, Limited Retirement or End of Support dates are published for them yet, so our EOS Edge Device feed carries them as no date announced. Applying SonicWall's own Gen 6 cadence — roughly two years from last order to the firmware cut-off and four to five years to End of Support — is a forecast, not a vendor date, and we do not print it as one. The point is narrower: a Gen 6 replacement bought today should be a current Gen 7 model, not a TZ270 or NSa 2700 on clearance.

Working back from October 1

The inventory: the models in the table above, physical and (for the NSv 10 to 1600) virtual, including the branch-office TZ boxes that were installed once and forgotten. SonicWall's tables are per model, so a serial-number export from the management console maps directly to the rows above.

The order of operations: (1) anything on the August 1 list is already out of support — replace it first; (2) for the October 1 list, replacement hardware ordered now is a September project with a two-week margin, not an October one; (3) land on a current SonicOS 7.3 release on Gen 7 hardware, noting the 7.3.0 to 7.3.2 End of Support on September 30, 2026; (4) retire the old firewalls rather than demoting them to a lab or a secondary site, because an unsupported SonicWall that still terminates SSL-VPN is the KEV pattern above waiting to repeat.

Frequently Asked Questions

Related

• SonicWall Firewalls (TZ / NSa / NSsp hardware) — every model with live status · SonicOS · SMA 100
• The September 30, 2026 cluster — SonicOS 7.3.x, FortiOS 7.2 and the rest of that day
• The EOS Edge Device List — 25 platforms, vendor-verified, machine-readable
• End of support & the BOD 26-02 clock · Exploited & Unpatchable