Sonicwall GMS vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Sonicwall GMS: 6 record(s), with affected versions and fixes.
CVE-2026-66154
High · 8.3
CWE-295 Aug 11, 2026
Improper Certificate Validation in Sonicwall GMS
An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.
CVE-2026-66148
Medium · 6.3
CWE-94 Aug 11, 2026
Code Injection in Sonicwall GMS
An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges.
CVE-2026-66147
Critical · 9.4
CWE-94 Aug 11, 2026
Code Injection in Sonicwall GMS
An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.
CVE-2026-18634
High · 8.4
CWE-502 Aug 11, 2026
Deserialization of Untrusted Data in Sonicwall GMS
An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component.
CVE-2026-66146
Medium · 6.1
CWE-79 Aug 11, 2026
Cross-site Scripting (XSS) in Sonicwall GMS
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.
CVE-2026-66145
Critical · 9.1
CWE-94 Aug 11, 2026
Code Injection in Sonicwall GMS
An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.