CVE-2026-66145: GMS Unauthenticated RCE Vulnerability

CVE-2026-66145 Overview

CVE-2026-66145 is an unauthenticated remote code execution vulnerability affecting SonicWall Global Management System (GMS) version 9.5.1 (Build 9510.1044) and earlier. The flaw allows a remote attacker to read sensitive data and perform arbitrary file writes through a zip slip condition. Successful exploitation can lead to code execution on the underlying management platform. The issue is categorized under [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact
Remote, unauthenticated attackers can write arbitrary files on GMS instances through crafted archive uploads, enabling code execution and exposure of sensitive management data.

Affected Products

SonicWall GMS 9.5.1 (Build 9510.1044)
SonicWall GMS versions earlier than 9.5.1 (Build 9510.1044)
Deployments exposing the GMS management interface to untrusted networks

Discovery Timeline

2026-08-11 - CVE-2026-66145 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-66145

Vulnerability Analysis

The vulnerability resides in the archive extraction logic of SonicWall GMS. When the application processes an uploaded ZIP archive, it fails to sanitize entry file paths before writing them to disk. An attacker can craft archive entries containing path traversal sequences that escape the intended extraction directory. This class of flaw is commonly referred to as zip slip.

Because the endpoint accepting the archive does not require authentication, exploitation requires no valid credentials. Attackers can place arbitrary files anywhere the GMS process has write access. Overwriting configuration files, scheduled task definitions, or web-accessible scripts yields code execution in the context of the GMS service.

The advisory also states that sensitive data can be read, which suggests the extraction or upload workflow returns file contents or metadata that expose secrets. Combined, read and write primitives enable full compromise of the management platform.

Root Cause

The root cause is missing validation of archive entry names during extraction. The implementation concatenates entry names to a base directory without verifying that the resolved path remains inside that directory. Entries containing ../ sequences resolve to arbitrary locations on the filesystem.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a crafted ZIP archive to the vulnerable GMS endpoint. Upon extraction, malicious entries are written to attacker-chosen paths, after which follow-up requests trigger the planted payload. See the SonicWall Vulnerability Advisory SNWLID-2026-0011 for vendor guidance.

No verified proof-of-concept exploit is publicly available at the time of publication.

Detection Methods for CVE-2026-66145

Indicators of Compromise

Unexpected files written outside standard GMS application directories, particularly under web roots, cron directories, or service configuration paths
HTTP requests to GMS upload endpoints from unknown external sources containing multipart archive payloads
New or modified .jsp, .war, or script files in GMS-served directories that do not match vendor release contents
GMS process spawning shells, interpreters, or network utilities not associated with normal operation

Detection Strategies

Inspect archive uploads to GMS for entry names containing ../, absolute paths, or non-canonical separators
Baseline GMS installation directories and alert on file writes outside expected locations
Correlate anonymous or pre-authentication requests to management endpoints with subsequent file system changes

Monitoring Recommendations

Enable verbose access logging on the GMS web tier and ship logs to a central SIEM for retention and correlation
Monitor outbound connections from GMS hosts for reverse shells, tunneling tools, or connections to unfamiliar destinations
Alert on service restarts, configuration reloads, or scheduled task changes on GMS servers

How to Mitigate CVE-2026-66145

Immediate Actions Required

Restrict network access to the GMS management interface to trusted administrative networks only
Apply the vendor-supplied fix referenced in SNWLID-2026-0011 as soon as it is available for your deployment
Audit GMS filesystems for unauthorized files written outside expected directories
Rotate credentials, API tokens, and certificates managed by any GMS instance suspected of compromise

Patch Information

SonicWall has published advisory SNWLID-2026-0011 documenting affected versions and remediation guidance. Administrators should upgrade GMS to a release later than 9.5.1 (Build 9510.1044) once the fixed build identified by the vendor is deployed. Refer to the SonicWall PSIRT advisory for exact fixed build numbers and upgrade procedures.

Workarounds

Place the GMS management interface behind a VPN or jump host and block direct internet exposure
Enforce network-layer access controls that limit archive upload endpoints to authorized management stations
Disable or restrict features that accept archive uploads until the patched version is installed

bash

# Example: restrict GMS management access at the firewall
# Allow only the administrative subnet to reach the GMS web tier
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP