EUVD-2026-56941
GHSA-2x4r-qjw8-2rm8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Unauthenticated network-reachable command injection with low complexity yields full OS code execution, so PR:N/UI:N/AC:L and C:H/I:H/A:H - confidentiality raised to High versus the source vector's C:L.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.
AnalysisAI
Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticated command injection flaw in the GMS Dispatcher Service, letting remote attackers run arbitrary operating-system commands on the management server via specially crafted requests. Because GMS centrally administers fleets of SonicWall firewalls, a compromise cascades into control over every managed appliance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the GMS Dispatcher Service on a GMS instance running version 9.5.1 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special product configuration are required against an exposed Dispatcher Service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals mostly align toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and SSVC records Technical Impact as 'total,' consistent with full RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the GMS management server over the network sends a specially crafted request to the Dispatcher Service that embeds shell metacharacters or an injected command, which the service executes on the underlying host without requiring authentication. With code execution on the central management platform, the attacker can pivot to reconfigure or push changes to every SonicWall firewall the GMS instance manages. … |
| Remediation | Consult SonicWall PSIRT advisory SNWLID-2026-0011 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011) and upgrade GMS to the fixed release identified there; no exact fixed version was included in the provided intelligence, so treat the advisory as the authoritative source for the target build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: isolate GMS instances on segmented networks and implement strict access controls limiting Dispatcher Service connectivity to trusted administrator IPs only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Insecure deserialization in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier enables a local
Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier expo
Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged use
Same weakness CWE-94 – Code Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today