CVE-2026-66147

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66147", "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315", "state": "PUBLISHED", "assignerShortName": "sonicwall", "dateReserved": "2026-07-24T08:34:11.798Z", "datePublished": "2026-08-11T20:08:56.193Z", "dateUpdated": "2026-08-12T14:46:43.933Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315", "shortName": "sonicwall", "dateUpdated": "2026-08-11T20:08:56.193Z"}, "datePublic": "2026-08-11T20:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "affected": [{"vendor": "SonicWall", "product": "GMS", "platforms": ["Windows", "Linux"], "versions": [{"status": "affected", "version": "9.5.1 and earlier versions"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests."}]}], "references": [{"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011", "tags": ["vendor-advisory"]}], "source": {"advisory": "SNWLID-2026-0011", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T04:00:43.777245Z", "id": "CVE-2026-66147", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T14:46:43.933Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-66147", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T04:00:43.777245Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T21:11:48.591Z"}}], "cna": {"source": {"advisory": "SNWLID-2026-0011", "discovery": "EXTERNAL"}, "affected": [{"vendor": "SonicWall", "product": "GMS", "versions": [{"status": "affected", "version": "9.5.1 and earlier versions"}], "platforms": ["Windows", "Linux"], "defaultStatus": "unknown"}], "datePublic": "2026-08-11T20:00:00.000Z", "references": [{"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315", "shortName": "sonicwall", "dateUpdated": "2026-08-11T20:08:56.193Z"}}}, "cveMetadata": {"cveId": "CVE-2026-66147", "state": "PUBLISHED", "dateUpdated": "2026-08-12T14:46:43.933Z", "dateReserved": "2026-07-24T08:34:11.798Z", "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315", "datePublished": "2026-08-11T20:08:56.193Z", "assignerShortName": "sonicwall"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "platforms": ["Windows", "Linux"], "product": "GMS", "vendor": "SonicWall", "versions": [{"status": "affected", "version": "9.5.1 and earlier versions"}]}], "source": "PSIRT@sonicwall.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos no autenticada fue identificada en el Servicio GMS Dispatcher en GMS 9.5.1 y versiones anteriores, que permite al atacante realizar ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de solicitudes especialmente dise\u00f1adas."}], "id": "CVE-2026-66147", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66147", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T04:00:43.777245Z", "version": "2.0.3"}}]}, "published": "2026-08-11T21:17:49.173", "references": [{"source": "PSIRT@sonicwall.com", "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"}], "sourceIdentifier": "PSIRT@sonicwall.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "PSIRT@sonicwall.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["Windows", "Linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.5.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "gms", "vendor": "sonicwall"}], "created": "2026-08-12T14:30:03.266134+00:00", "updated": "2026-08-13T10:39:44.172066+00:00", "vendors": ["sonicwall", "sonicwall$PRODUCT$gms"]}