What is the CVSS score of EUVD-2026-56941?

EUVD-2026-56941 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of SonicWall GMS are affected by EUVD-2026-56941?

SonicWall Global Management System (GMS) 9.5.1 and earlier contain an unauthenticated remote code execution vulnerability that grants attackers complete control over the centralized management…

How to fix or mitigate EUVD-2026-56941?

Within 24 hours: isolate GMS instances on segmented networks and implement strict access controls limiting Dispatcher Service connectivity to trusted administrator IPs only. Although no public exploit has been identified at time of analysis, the critical nature of this vulnerability warrants immediate defensive action. Within 7 days: deploy enhanced monitoring and logging on all GMS instances to detect anomalous command execution patterns, and conduct inventory of all GMS 9.5.1 and earlier deployments to assess organizational exposure scope. Within 30 days: maintain coordination with SonicWall for patch availability and workarounds, sustain heightened monitoring for indicators of compromise, and develop an incident response plan specific to GMS compromise scenarios.

SonicWall GMS EUVD-2026-56941

| CVE-2026-66147 CRITICAL

Code Injection (CWE-94)

2026-08-11 sonicwall

GHSA-2x4r-qjw8-2rm8

RCE Command Injection Code Injection Sonicwall Gms

9.4

CVSS 3.1 · Vendor: sonicwall

Severity by source

Vendor (sonicwall) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection with low complexity yields full OS code execution, so PR:N/UI:N/AC:L and C:H/I:H/A:H - confidentiality raised to High versus the source vector's C:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (sonicwall).

CVSS VectorVendor: sonicwall

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:38 vuln.today

CVE Published

Aug 11, 2026 - 20:08 cve.org

CRITICAL 9.4

DescriptionCVE.org

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.

AnalysisAI

Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticated command injection flaw in the GMS Dispatcher Service, letting remote attackers run arbitrary operating-system commands on the management server via specially crafted requests. Because GMS centrally administers fleets of SonicWall firewalls, a compromise cascades into control over every managed appliance. No public exploit identified at time of analysis, though the CVSS 9.4 rating and 'total' technical impact make this a high-priority patch target.

Technical ContextAI

GMS is SonicWall's centralized management and reporting platform for administering SonicWall firewall fleets, and the affected component is its Dispatcher Service, which handles inbound requests to the management server. The root cause is CWE-94 (Improper Control of Generation of Code / code injection), here manifesting as command injection where attacker-controlled input in a crafted request is passed into an OS command context without adequate sanitization, allowing arbitrary command execution. The single affected CPE, cpe:2.3:a:sonicwall:gms:*, confirms the scope is the GMS application itself rather than an underlying firewall firmware component.

RemediationAI

Consult SonicWall PSIRT advisory SNWLID-2026-0011 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011) and upgrade GMS to the fixed release identified there; no exact fixed version was included in the provided intelligence, so treat the advisory as the authoritative source for the target build. Until patched, restrict network reachability of the GMS Dispatcher Service - place the GMS management interface on an isolated management VLAN, block external and untrusted access to its service ports at the perimeter, and permit connections only from known administrative hosts and managed appliances; the trade-off is that overly aggressive filtering can disrupt appliance-to-GMS reporting and management traffic, so allow-list managed device IPs rather than broadly blocking. Monitor GMS server logs and host process activity for unexpected command execution as a detective control.