CVE-2026-66145

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Remote Code Execution in GMS

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: SonicWALL, Inc.

Description

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-66145

EUVD

EUVD-2026-56938

Affected Vendors & Products

Vendor	Product	Version / Range
sonicwall	gms	to 9.5.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This is an unauthenticated remote code execution vulnerability in SonicWall GMS versions 9.5.1 (Build 9510.1044) and earlier. It allows a remote attacker to read sensitive data and perform arbitrary file writes through a zipslip attack.

Detection Guidance

To detect this vulnerability, check for unauthorized file writes or suspicious zip file handling in GMS 9.5.1 or earlier versions. Monitor logs for unusual activity and verify if zipslip patterns exist in file operations.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system, steal sensitive data, or write malicious files to your system without authentication.

Compliance Impact

This vulnerability allows remote attackers to read sensitive data and perform arbitrary file writes, which could lead to unauthorized access to personal or protected health information. Such breaches may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information, potentially resulting in non-compliance and legal penalties.

Mitigation Strategies

Immediately update GMS to version 9.5.1 (Build 9510.1044) or later to address the vulnerability. If updating is not possible, restrict network access to GMS interfaces and disable unnecessary services to reduce exposure.

Hi! I’m here to help you understand CVE-2026-66145. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70