SonicWall GMS Flaws Enable Remote Code Execution
Six vulnerabilities in SonicWall GMS, including two unauthenticated RCE bugs, could let attackers fully compromise management servers.
A set of six vulnerabilities has been disclosed in SonicWall's Global Management System (GMS), a centralized console used to manage SonicWall firewalls, wireless, email security, and remote access appliances. The most severe issues include an unauthenticated remote code execution flaw via zip slip path traversal (CVE-2026-66145) and an unauthenticated command injection vulnerability (CVE-2026-66147), both of which allow a remote, unauthenticated attacker to execute arbitrary code in the context of the GMS service account. Additional flaws include authenticated command injection allowing privilege escalation to root (CVE-2026-66148), multiple XSS vulnerabilities (CVE-2026-66146), insecure deserialization (CVE-2026-18634), and insufficient certificate validation exploitable under MitM conditions (CVE-2026-66154).
Because GMS is used to centrally manage security infrastructure across an organization, successful exploitation could give an attacker a pivot point to compromise downstream firewalls, VPNs, and email security appliances, depending on the privileges of the affected service account. There are currently no reports of in-the-wild exploitation, but the presence of unauthenticated RCE vectors in an internet-facing management product makes this a high-value target for future exploitation, particularly given historical attacker interest in SonicWall products. Affected versions are GMS 9.5.1 and earlier (Virtual Appliance and Windows). MS-ISAC recommends prompt patching, least-privilege configuration of service accounts, network segmentation, and vulnerability scanning to mitigate risk.
Mentioned in this report
Detection guidance
SonicWall GMS Zip Slip Path Traversal Upload
Detects HTTP multipart file uploads to SonicWall GMS containing zip archives with path traversal sequences (../) in archived entry names, exploiting CVE-2026-66145 zip slip vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SonicWall GMS Zip Slip Path Traversal Upload
description: Detects HTTP POST requests to SonicWall GMS file upload endpoints containing
zip archive files with path traversal patterns (..) in the archive structure, exploiting
CVE-2026-66145 zip slip flaw for unauthenticated RCE.
tags:
- attack.t1190
- attack.initial-access
logsource:
category: proxy
product: proxy
detection:
selection_gms_upload:
c-uri|contains:
- /gms/upload
- /api/upload
- /api/backup
cs-method: POST
selection_zip_content:
cs-content-type|contains: application/zip
selection_traversal:
cs-referer|contains: ..
selection_no_auth:
cs-authorization: ''
condition: selection_gms_upload and selection_zip_content and selection_traversal
and selection_no_auth
falsepositives:
- Legitimate backup restoration by authenticated administrators
- Software deployment scripts uploading patches
level: high
id: aa4a3fa8-d464-53e0-8632-d5af6558c12b
status: experimental
author: Vorant
SonicWall GMS Service Account Privilege Escalation
Detects process execution or command invocation with elevated privileges originating from SonicWall GMS service process, following authenticated command injection exploitation (CVE-2026-66148) leading to privilege escalation to root/SYSTEM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SonicWall GMS Service Account Privilege Escalation
description: Detects child processes spawned by SonicWall GMS service (gms.exe, gmsvc)
with privilege elevation indicators (sudo, runas, whoami, id returning 0) or execution
as SYSTEM/root, typical of post-exploitation privilege escalation following command
injection.
tags:
- attack.t1190
- attack.privilege-escalation
logsource:
category: process_creation
product: windows
detection:
selection_gms_parent:
ParentImage|contains:
- gms.exe
- gmsvc
- SonicWall
selection_privesc_indicators:
CommandLine|contains:
- 'sudo '
- 'runas '
- whoami
- id
User|contains:
- SYSTEM
- root
- NT AUTHORITY\\SYSTEM
filter_legitimate_monitoring:
Image|endswith:
- tasklist.exe
- wmic.exe
CommandLine|contains: query process
condition: selection_gms_parent and selection_privesc_indicators and not filter_legitimate_monitoring
falsepositives:
- System health monitoring scripts running privilege checks
- Legitimate GMS administrative tasks querying system status
level: medium
id: 4ca1fc89-2337-5a24-b691-c0aae7d209c4
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-gms-could-allow-for-remote-code-execution_2026-083
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free