Unauthenticated command injection in SonicWall GMS Dispatcher Service (CVE-2026-66147)

An unauthenticated command injection vulnerability exists in the GMS Dispatcher Service in SonicWall GMS 9.5.1 and earlier versions. A remote attacker can exploit this vulnerability through specially crafted requests to achieve remote code execution without any authentication. Affected versions: - GMS - Virtual Appliance and Windows 9.5.1 and earlier versions We recommend updating to: GMS - Virtual Appliance and Windows 9.5.2. CVSS 9.4 · our assessment: act_now Reference: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011 Details: https://vuln.today/cve/CVE-2026-66147