Unauthenticated Command Injection in GMS Dispatcher Service by SonicWall
CVE-2026-66147

9.4CRITICAL

Key Information:

Vendor

Sonicwall
Status
Gms
Vendor
CVE Published:
11 August 2026

What is CVE-2026-66147?

An unauthenticated command injection vulnerability has been uncovered in the GMS Dispatcher Service of SonicWall's GMS product, specifically affecting versions 9.5.1 and earlier. This vulnerability enables a remote attacker to execute arbitrary commands on the affected system by sending specially crafted requests. Organizations using susceptible versions of GMS are urged to implement necessary security measures to mitigate risks associated with potential remote code execution.

Affected Version(s)

GMS Windows 9.5.1 and earlier versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-202...
vendor-advisory

CVSS V3.1

Score:
9.4
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.