SonicWall GMS Flaws Enable Remote Code Execution

Published12 August 2026 Vorant ratingroutine vulnerability TechnologyGovernment (National)

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Six vulnerabilities in SonicWall GMS, including two unauthenticated RCE bugs, could let attackers fully compromise management servers.

Sourcecisecurity.org — open the original

What to check

Applies to: The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

A set of six vulnerabilities has been disclosed in SonicWall's Global Management System (GMS), a centralized console used to manage SonicWall firewalls, wireless, email security, and remote access appliances. The most severe issues include an unauthenticated remote code execution flaw via zip slip path traversal (CVE-2026-66145) and an unauthenticated command injection vulnerability (CVE-2026-66147), both of which allow a remote, unauthenticated attacker to execute arbitrary code in the context of the GMS service account. Additional flaws include authenticated command injection allowing privilege escalation to root (CVE-2026-66148), multiple XSS vulnerabilities (CVE-2026-66146), insecure deserialization (CVE-2026-18634), and insufficient certificate validation exploitable under MitM conditions (CVE-2026-66154).

Because GMS is used to centrally manage security infrastructure across an organization, successful exploitation could give an attacker a pivot point to compromise downstream firewalls, VPNs, and email security appliances, depending on the privileges of the affected service account. There are currently no reports of in-the-wild exploitation, but the presence of unauthenticated RCE vectors in an internet-facing management product makes this a high-value target for future exploitation, particularly given historical attacker interest in SonicWall products. Affected versions are GMS 9.5.1 and earlier (Virtual Appliance and Windows). MS-ISAC recommends prompt patching, least-privilege configuration of service accounts, network segmentation, and vulnerability scanning to mitigate risk.

Mentioned in this report

Vulnerabilities CVE-2026-18634CVE-2026-66145CVE-2026-66146CVE-2026-66147CVE-2026-66148CVE-2026-66154

Detection guidance

SonicWall GMS Service Account Privilege Escalation

ATT&CK T1190 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects process execution or command invocation with elevated privileges originating from SonicWall GMS service process, following authenticated command injection exploitation (CVE-2026-66148) leading to privilege escalation to root/SYSTEM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: SonicWall GMS Service Account Privilege Escalation
description: Detects child processes spawned by SonicWall GMS service (gms.exe, gmsvc)
  with privilege elevation indicators (sudo, runas, whoami, id returning 0) or execution
  as SYSTEM/root, typical of post-exploitation privilege escalation following command
  injection.
tags:
- attack.t1190
- attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_gms_parent:
    ParentImage|contains:
    - gms.exe
    - gmsvc
    - SonicWall
  selection_privesc_indicators:
    CommandLine|contains:
    - 'sudo '
    - 'runas '
    - whoami
    - id
    User|contains:
    - SYSTEM
    - root
    - NT AUTHORITY\\SYSTEM
  filter_legitimate_monitoring:
    Image|endswith:
    - tasklist.exe
    - wmic.exe
    CommandLine|contains: query process
  condition: selection_gms_parent and selection_privesc_indicators and not filter_legitimate_monitoring
falsepositives:
- System health monitoring scripts running privilege checks
- Legitimate GMS administrative tasks querying system status
level: medium
id: 4ca1fc89-2337-5a24-b691-c0aae7d209c4
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-gms-could-allow-for-remote-code-execution_2026-083

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs