CVE-2026-66147

Full vulnerability record from the local CVENow database.

Description

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.

Severity

CRITICAL

CVSS score

9.4 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-08-11 21:17:49.173000

Last modified

2026-10-24 16:10:00.153000

View original CVE JSON

{
  "id": "CVE-2026-66147",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T21:17:49.173",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de comandos no autenticada fue identificada en el Servicio GMS Dispatcher en GMS 9.5.1 y versiones anteriores, que permite al atacante realizar ejecución remota de código a través de solicitudes especialmente diseñadas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SonicWall",
          "product": "GMS",
          "defaultStatus": "unknown",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "versions": [
            {
              "version": "9.5.1 and earlier versions",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T04:00:43.777245Z",
          "id": "CVE-2026-66147",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011",
      "source": "[email protected]"
    }
  ]
}