SonicWall GMS Unauthenticated Command Injection RCE

Executive Summary

A critical unauthenticated remote code execution (RCE) vulnerability has been identified in SonicWall Global Management System (GMS) versions 9.5.1 and earlier. Tracked as CVE-2026-66147 with a CVSS score of 9.4, the flaw allows a remote, unauthenticated attacker to execute arbitrary OS commands by sending specially crafted requests to the GMS Dispatcher Service.

Organizations running on-premises GMS deployments should treat this as an emergency patching priority.

Vulnerability Details

Technical Analysis

The vulnerability resides in the GMS Dispatcher Service, a core component of SonicWall's centralized network management platform. The service fails to properly sanitize externally supplied input before incorporating it into OS-level command strings.

An attacker with network access to the GMS interface can send a specially crafted HTTP request to the Dispatcher Service endpoint, injecting arbitrary shell commands that execute with the privileges of the GMS service process — typically with elevated system rights.

Attack Characteristics

• No credentials required: The vulnerability is exploitable pre-authentication, dramatically lowering the bar for exploitation
• No user interaction needed: Fully remote and automated exploitation is possible
• High-impact outcome: Successful exploitation grants arbitrary command execution on the underlying host OS
• Network-accessible: GMS is commonly exposed to management networks or, in misconfigured deployments, directly to the internet

Why This Is Dangerous

SonicWall GMS is a management plane product — it sits above and controls firewall policies, VPN gateways, and security services across an organization's entire SonicWall fleet. Compromise of GMS does not merely affect a single device; it can provide an attacker with the ability to:

• Modify firewall rules to open network access
• Intercept or redirect VPN traffic
• Disable security monitoring and logging
• Pivot laterally throughout the managed network

Affected Products

Recommended Actions

Immediate Steps

1. Patch now: Update SonicWall GMS to the latest patched version as soon as it is available from SonicWall's product portal
2. Restrict access: Place GMS behind a VPN or restrict management-plane access to trusted IP ranges using firewall ACLs
3. Audit exposure: Confirm GMS is not directly exposed to the internet; use Shodan or similar tools to assess external visibility
4. Review logs: Check GMS Dispatcher Service logs for anomalous or unexpected requests that may indicate prior exploitation

Detection Guidance

Look for unexpected process spawning from the GMS Dispatcher Service process, unusual outbound connections from the GMS host, or new user accounts and scheduled tasks created on the system. Endpoint detection tools should flag command execution originating from the web service process context.

Vendor Response

SonicWall has published a security advisory for CVE-2026-66147. Organizations should consult the SonicWall Product Security Incident Response Team (PSIRT) portal for the latest patch availability and remediation guidance.

References

• NVD Entry: CVE-2026-66147
• SonicWall PSIRT Portal