Paper/Archive/CVE-2026-66147

CVE-2026-66147

SonicWall GMS — An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which a…

EPSS 2%CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (ADP)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 78.0.780 × 2015.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.

Affected

ProductAffectedFixed inSource

GMS9.5.1 and earlier versions–CNA

Scores by source

CISA ADP9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorypsirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011