What is the CVSS score of CVE-2026-66154?

CVE-2026-66154 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of SonicWall GMS are affected by CVE-2026-66154?

SonicWall Global Management System (GMS) versions 9.5.1 and earlier contain a certificate validation flaw allowing unauthenticated attackers with adjacent network access to intercept and manipulate…

How to fix or mitigate CVE-2026-66154?

Within 24 hours, identify all systems running SonicWall GMS 9.5.1 (Build 9510.1044) or earlier and restrict administrative network access to this system to trusted internal networks only-do not expose GMS to untrusted segments or the internet. Within 7 days, implement network segmentation isolating GMS from general business networks, deploy network-based monitoring to detect unauthorized certificate presentations or configuration changes to managed appliances, and establish logging for all administrative access and configuration push activities to managed SonicWall systems. Within 30 days, contact SonicWall for patch availability and timelines, evaluate upgrading to patched GMS versions if available, and establish a formal change control log for all managed appliance configurations to detect unauthorized modifications.

SonicWall GMS CVE-2026-66154

EUVD-2026-56943 HIGH

Improper Certificate Validation (CWE-295)

2026-08-11 sonicwall

GHSA-5h7r-wrwv-5rj5

Authentication Bypass Sonicwall Gms

8.3

CVSS 3.1 · Vendor: sonicwall

Severity by source

Vendor (sonicwall) PRIMARY

8.3 HIGH

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Adjacent vector and high complexity reflect the required MitM positioning on the management segment; scope change captures total impact on managed appliances beyond the GMS host.

3.1 AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (sonicwall).

CVSS VectorVendor: sonicwall

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:37 vuln.today

CVE Published

Aug 11, 2026 - 20:12 cve.org

HIGH 8.3

DescriptionCVE.org

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.

AnalysisAI

Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier exposes a privileged internal communication workflow to man-in-the-middle interception, enabling an attacker with adjacent network access to present a fraudulent certificate the application accepts without proper verification. Under controlled network conditions allowing a successful MitM position, an unauthenticated attacker (per CVSS PR:N) can read, modify, or inject data into what GMS treats as a trusted management channel, resulting in unauthorized configuration changes that propagate to managed SonicWall infrastructure. No active exploitation has been confirmed (SSVC exploitation: none) and no public exploit is identified at time of analysis, though the S:C scope change elevates potential downstream impact across the full managed appliance fleet.

Technical ContextAI

SonicWall Global Management System (GMS) is an enterprise centralized management and analytics platform for SonicWall firewall and security appliances, identified via CPE cpe:2.3:a:sonicwall:gms:*:*:*:*:*:*:*:*. The root cause is CWE-295 (Improper Certificate Validation): during a specific privileged internal communication workflow, the application fails to rigorously verify the server certificate presented to it, meaning an attacker who intercepts adjacent-network traffic can substitute a forged certificate that GMS accepts as legitimate. This class of flaw collapses the trust model of a channel the application treats as authenticated and confidential, enabling the Authentication Bypass behavior reflected in the vulnerability tags - the attacker effectively inherits the trust level of the compromised workflow without possessing valid credentials. The flaw is scoped to specific privileged workflows within GMS rather than all application communication.

RemediationAI

The primary remediation is to upgrade SonicWall GMS to a version beyond 9.5.1 (Build 9510.1044) per SonicWall PSIRT advisory SNWLID-2026-0011, available at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011; the advisory should be consulted directly for the specific patched release version, as an exact fix version number is not independently confirmed in currently available intelligence. As a compensating control pending upgrade, administrators should enforce strict network segmentation to ensure the GMS management network is isolated from untrusted hosts, directly reducing an attacker's ability to achieve the adjacent-network MitM position required for exploitation - this does not remediate the certificate validation flaw itself but meaningfully raises the barrier for exploitation. Deploying 802.1X or similar port-based network access control on the management VLAN can further prevent unauthorized devices from intercepting GMS privileged traffic, though this introduces additional operational overhead for device onboarding. Monitoring the management segment for anomalous ARP activity, duplicate MAC addresses, or unexpected certificate subjects in TLS sessions can provide early warning of attempted MitM interception.