Unauthenticated remote code execution via zipslip in SonicWall GMS (CVE-2026-66145)

An unauthenticated remote code execution vulnerability exists in SonicWall GMS 9.5.1 (Build 9510.1044) and earlier versions. A remote attacker can exploit this flaw via zipslip to read sensitive data and perform arbitrary file writes without any authentication. This vulnerability is classified as improper control of code generation (CWE-94) and carries a CVSS v3 score of 9.1. Affected versions: - GMS - Virtual Appliance and Windows 9.5.1 and earlier versions We recommend updating to: GMS - Virtual Appliance and Windows 9.5.2. CVSS 9.1 · our assessment: act_now Reference: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011 Details: https://vuln.today/cve/CVE-2026-66145