Vulnerability · Published Aug 11, 2026 · Assigned by sonicwall

CVE-2026-66145

Critical 9.1

In plain English

A critical-severity code injection in GMS from SonicWall. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.7%top 48.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.

Affected products (as reported)

Vendor	Product	Versions
SonicWall	GMS	9.5.1 and earlier versions

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011 vendor-advisory