CVE-2026-661479.4CriticalCWE-94
CVE-2026-66147: SonicWall GMS vulnerability
SonicWall · GMS
Vendor fix available · Affected: SonicWall GMS · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
1.8%probability of exploitation in the next 30 days
78th percentile
050100
Higher than 78% of scored CVEs
9.4CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- SonicWall
- Published
- August 2026
Coverage2 articles · 2 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 12 Aug.
Quiet for 14 weekslast report 12 Aug2 articles2 outlets
- Wed 12 Aug, 02:31 UTC. SecurityOnline, first report. SonicWall fixes critical RCE bug CVE-2026-66147 in GMS, Email.
- Wed 12 Aug, 08:02 UTC. SecurityWeek, its first report on the story. SonicWall patches GMS RCE flaws CVE-2026-66147, CVE-2026-66145.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 12 Aug 02:31 | SecurityOnline | SonicWall fixes critical RCE bug CVE-2026-66147 in GMS, Email |
| 12 Aug 08:02 | SecurityWeek | SonicWall patches GMS RCE flaws CVE-2026-66147, CVE-2026-66145 |
- SonicWall fixes critical RCE bug CVE-2026-66147 in GMS, EmailSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.