An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1

CVE-2026-66145 is an unauthenticated remote code execution vulnerability in SonicWall Global Management System (GMS) version 9.5.1 (Build 9510.1044) and earlier. The flaw exploits a classic Zip Slip path traversal during archive extraction: an attacker sends a specially crafted archive to a GMS endpoint, and the server extracts files with ../ sequences in their names without validation. This allows arbitrary file writes outside the intended directory — overwriting executables, dropping webshells, or planting cron jobs — ultimately achieving code execution as the GMS service account. The bug also enables reading sensitive data from the server, including firewall credentials and configuration data managed by GMS. Both the Virtual Appliance and Windows editions are affected. The fix is GMS 9.5.2.

SonicWall's CRITICAL 9.1 rating is technically defensible given the unauth/no-interaction/network-accessible vector. However, it overstates the real-world risk for most shops. GMS was retired in October 2025 and reaches end-of-support in September 2026 — the installed base is actively shrinking as customers migrate to NSM. GMS servers should live on isolated management VLANs, not the internet. No public PoC exists, EPSS sits at the 0.557% mark, and SonicWall confirms zero in-the-wild exploitation. The severity is real — this thing manages your firewalls — but the practical exposure window is narrower than a vanilla 9.1 suggests. We downgrade to HIGH 8.0.

Why this verdict

• Unauth + no interaction = high weaponization ceiling. The CVSS vector is textbook worst-case for access requirements: no credentials, no clicks, just network reachability. If a PoC drops, exploitation will be trivially scriptable.
• Role multiplier: GMS is a network-edge-appliance management server. Every GMS instance by definition manages SonicWall firewalls — the network perimeter. Compromise of GMS yields stored credentials, configuration push capability, and policy control over the entire managed firewall fleet. This is fleet-scale network compromise from a single pivot. The floor is HIGH.
• EOL product with shrinking install base. GMS was retired in October 2025 and loses all support September 2026. Orgs should already be migrating to NSM. The population of actively-managed GMS instances is declining month over month, which narrows the real-world target surface.
• No PoC, no exploitation, low EPSS. As of 18 days post-disclosure, no public exploit exists, SonicWall confirms zero wild exploitation, and EPSS is 0.557%. This is meaningful friction against near-term weaponization.
• Internal-only deployment norm. GMS management interfaces should live on isolated management VLANs. Unlike SonicWall firewalls themselves (430K+ internet-facing), GMS has negligible internet exposure per Shodan/Censys. An attacker needs prior internal access to reach it.

Why not higher?

CRITICAL would require either active exploitation, a public PoC ready for mass scanning, or internet-facing exposure. None of these conditions exist. The product is EOL with a shrinking installed base, and reaching the vulnerable interface requires internal network access — meaning the attacker is already past the perimeter. The blast radius is serious but gated behind a non-trivial prerequisite.

Why not lower?

MEDIUM or LOW would ignore the devastating blast radius of compromising a firewall management server. Even with all the friction, a single successful exploit hands the attacker the keys to every managed SonicWall appliance — firewall rules, VPN configs, credentials. The role multiplier floors this at HIGH regardless of the access friction. Additionally, the zipslip technique is well-understood and reliable once the endpoint is identified.

1. Isolate GMS to a dedicated management VLAN with strict ACLs — Restrict inbound access to the GMS management interface to only authorized admin workstations by IP. This is the single most effective control — it eliminates the network reachability prerequisite. Deploy within 30 days per the noisgate mitigation SLA for HIGH severity.
2. Accelerate migration to NSM — GMS is EOL. The permanent fix is decommissioning it entirely and migrating to SonicWall Network Security Manager (NSM) SaaS or On-Prem. This eliminates the vulnerability surface permanently. Prioritize migration planning immediately.
3. Apply GMS 9.5.2 patch on all remaining GMS instances — This is the vendor's final-generation patch. Apply within the 30-day noisgate mitigation SLA. Test in staging first — given the EOL status, rollback options are limited.
4. Rotate all credentials stored in GMS — After patching, rotate API keys, firewall admin credentials, and any secrets managed through GMS. If compromise is suspected, rotate immediately.
5. Enable file integrity monitoring on GMS servers — Deploy FIM (OSSEC, Wazuh, or Tripwire) on GMS web root directories and system paths. Alert on any file creation or modification outside patch windows. This detects zipslip exploitation after the fact.

Run this script on the GMS server itself (Virtual Appliance) as root or via sudo. For Windows GMS, adapt the version check path. Example: sudo bash check_cve_2026_66145.sh. No network access required — it checks the installed GMS build version locally.

#!/bin/bash
# check_cve_2026_66145.sh
# Checks if SonicWall GMS is vulnerable to CVE-2026-66145 (Zip Slip RCE)
# Run on the GMS server as root.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

VULN_BUILD="9510.1044"
FIXED_VERSION="9.5.2"

# Try common GMS install paths for version info
GMS_PATHS=(
  "/opt/sonicwall/gms/conf/version.properties"
  "/opt/sonicwall/gms/version.txt"
  "/usr/local/sonicwall/gms/conf/version.properties"
)

VERSION_FILE=""
for p in "${GMS_PATHS[@]}"; do
  if [ -f "$p" ]; then
    VERSION_FILE="$p"
    break
  fi
done

if [ -z "$VERSION_FILE" ]; then
  # Check if GMS is even installed
  if ! command -v gmsd &>/dev/null && ! systemctl list-units --type=service 2>/dev/null | grep -qi gms; then
    echo "UNKNOWN - SonicWall GMS does not appear to be installed on this host."
    exit 2
  fi
  echo "UNKNOWN - GMS appears installed but version file not found. Check manually."
  exit 2
fi

echo "Found version file: $VERSION_FILE"
GMS_VERSION=$(grep -iE '(version|build)' "$VERSION_FILE" 2>/dev/null)
echo "Detected: $GMS_VERSION"

# Check for 9.5.2 or later
if echo "$GMS_VERSION" | grep -qE '9\.5\.[2-9]|9\.[6-9]|[1-9][0-9]\.'; then
  echo "PATCHED - GMS version is $FIXED_VERSION or later. CVE-2026-66145 is remediated."
  exit 0
elif echo "$GMS_VERSION" | grep -qE '9\.5\.1|9\.5\.0|9\.[0-4]|[0-8]\.'; then
  echo "VULNERABLE - GMS version is 9.5.1 or earlier. Affected by CVE-2026-66145."
  echo "ACTION: Upgrade to GMS 9.5.2 immediately or begin NSM migration."
  exit 1
else
  echo "UNKNOWN - Could not determine GMS version from file contents."
  exit 2
fi

Sources

1. SecurityWeek — SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform
2. CIS Advisory — Multiple Vulnerabilities in SonicWall GMS
3. CCB Belgium — Warning: Multiple vulnerabilities in SonicWall GMS
4. SonicWall — GMS End of Life and NSM Transition FAQ
5. SonicWall — GMS EOL Announcement
6. Snyk — Zip Slip Vulnerability Research
7. News4Hackers — SonicWall Issues Critical Security Update
8. THREATINT — CVE-2026-66145