Executive Summary
A critical unauthenticated remote code execution (RCE) vulnerability has been identified in SonicWall Global Management System (GMS) versions 9.5.1 and earlier. Tracked as CVE-2026-66147 with a CVSS score of 9.4, the flaw allows a remote, unauthenticated attacker to execute arbitrary OS commands by sending specially crafted requests to the GMS Dispatcher Service.
Organizations running on-premises GMS deployments should treat this as an emergency patching priority.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-66147 |
| CVSS Score | 9.4 (Critical) |
| Attack Vector | Network |
| Authentication Required | None |
| Affected Component | GMS Dispatcher Service |
| Affected Versions | SonicWall GMS 9.5.1 and earlier |
| Vulnerability Class | Command Injection / RCE |
Technical Analysis
The vulnerability resides in the GMS Dispatcher Service, a core component of SonicWall's centralized network management platform. The service fails to properly sanitize externally supplied input before incorporating it into OS-level command strings.
An attacker with network access to the GMS interface can send a specially crafted HTTP request to the Dispatcher Service endpoint, injecting arbitrary shell commands that execute with the privileges of the GMS service process — typically with elevated system rights.
Attack Characteristics
- No credentials required: The vulnerability is exploitable pre-authentication, dramatically lowering the bar for exploitation
- No user interaction needed: Fully remote and automated exploitation is possible
- High-impact outcome: Successful exploitation grants arbitrary command execution on the underlying host OS
- Network-accessible: GMS is commonly exposed to management networks or, in misconfigured deployments, directly to the internet
Why This Is Dangerous
SonicWall GMS is a management plane product — it sits above and controls firewall policies, VPN gateways, and security services across an organization's entire SonicWall fleet. Compromise of GMS does not merely affect a single device; it can provide an attacker with the ability to:
- Modify firewall rules to open network access
- Intercept or redirect VPN traffic
- Disable security monitoring and logging
- Pivot laterally throughout the managed network
Affected Products
| Product | Affected Versions |
|---|---|
| SonicWall Global Management System (GMS) | 9.5.1 and earlier |
Recommended Actions
Immediate Steps
- Patch now: Update SonicWall GMS to the latest patched version as soon as it is available from SonicWall's product portal
- Restrict access: Place GMS behind a VPN or restrict management-plane access to trusted IP ranges using firewall ACLs
- Audit exposure: Confirm GMS is not directly exposed to the internet; use Shodan or similar tools to assess external visibility
- Review logs: Check GMS Dispatcher Service logs for anomalous or unexpected requests that may indicate prior exploitation
Detection Guidance
Look for unexpected process spawning from the GMS Dispatcher Service process, unusual outbound connections from the GMS host, or new user accounts and scheduled tasks created on the system. Endpoint detection tools should flag command execution originating from the web service process context.
Vendor Response
SonicWall has published a security advisory for CVE-2026-66147. Organizations should consult the SonicWall Product Security Incident Response Team (PSIRT) portal for the latest patch availability and remediation guidance.