Vulnerability intelligence
CVE-2026-66147
An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.
CVSS Score
9.4
Critical
EPSS — Exploit Probability
1.8%
Riskier than 77% of all CVEs · checked 2026-09-26
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
2 articles across 2 outlets · first covered Aug 12, 2026 · latest Aug 12, 2026
Coverage timeline
-
SonicWall patches GMS RCE flaws CVE-2026-66147, CVE-2026-66145www.securityweek.com · Aug 12, 2026
-
SonicWall fixes critical RCE bug CVE-2026-66147 in GMS, Emailsecurityonline.info · Aug 12, 2026