CVE-2026-66147: GMS Dispatcher Service RCE Vulnerability

CVE-2026-66147 Overview

CVE-2026-66147 is an unauthenticated command injection vulnerability in the SonicWall Global Management System (GMS) Dispatcher Service. The flaw affects GMS version 9.5.1 and earlier releases. Remote attackers can send specially crafted requests to the Dispatcher Service and achieve remote code execution without authentication. The weakness is classified under CWE-94, Improper Control of Generation of Code (Code Injection). SonicWall published advisory SNWLID-2026-0011 to document the issue and provide fixed versions.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands on GMS servers over the network, compromising centralized firewall management infrastructure.

Affected Products

SonicWall Global Management System (GMS) 9.5.1
SonicWall Global Management System (GMS) versions earlier than 9.5.1
Deployments exposing the GMS Dispatcher Service to reachable networks

Discovery Timeline

2026-08-11 - CVE-2026-66147 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-66147

Vulnerability Analysis

The GMS Dispatcher Service accepts network requests and processes attacker-controlled input without sufficient validation. Because the service constructs commands or code paths from that input, an attacker can inject additional directives that the underlying interpreter executes. The result is arbitrary code execution in the context of the Dispatcher Service process.

GMS is a centralized management platform used by administrators to configure and monitor SonicWall firewall fleets. Compromise of a GMS server can expose credentials, policy data, and downstream device trust relationships. The vulnerability requires no user interaction and no prior authentication, which lowers the barrier to exploitation significantly.

Root Cause

The root cause is improper neutralization of input used in code or command generation, aligning with [CWE-94]. The Dispatcher Service passes untrusted request data into an execution context without safe parameterization or strict allow-listing. Any request field that reaches the vulnerable code path can be leveraged to alter the intended command structure.

Attack Vector

The attack vector is network-based. An attacker locates a reachable GMS Dispatcher Service endpoint and issues a crafted request containing injection payloads. The Dispatcher Service processes the payload and executes attacker-supplied commands. Because authentication is not required, exposure of the Dispatcher Service to untrusted networks converts directly into pre-authentication remote code execution risk. Refer to the SonicWall Vulnerability Advisory SNWLID-2026-0011 for vendor-confirmed technical details.

Detection Methods for CVE-2026-66147

Indicators of Compromise

Unexpected child processes spawned by the GMS Dispatcher Service process
Outbound network connections from the GMS host to unknown IP addresses following inbound Dispatcher requests
New or modified files in GMS installation and temporary directories that do not correspond to administrator actions
Anomalous shell interpreter invocations (cmd.exe, powershell.exe, /bin/sh) originating from GMS service accounts

Detection Strategies

Inspect GMS Dispatcher Service logs for malformed requests or requests containing shell metacharacters such as ;, |, &, and backticks
Correlate inbound requests to the Dispatcher Service port with subsequent process creation events on the GMS host
Baseline normal Dispatcher Service behavior and alert on deviations in process ancestry or outbound network activity

Monitoring Recommendations

Forward GMS host process, file, and network telemetry to a centralized analytics platform for correlation
Monitor authentication and configuration change events on managed SonicWall devices for signs of downstream abuse
Alert on any exposure of the GMS Dispatcher Service port to untrusted networks or the public internet

How to Mitigate CVE-2026-66147

Immediate Actions Required

Upgrade GMS to a version later than 9.5.1 as identified in SonicWall advisory SNWLID-2026-0011
Restrict network access to the GMS Dispatcher Service to trusted management networks only
Audit GMS servers for signs of prior exploitation, including unexpected processes, files, and outbound connections
Rotate credentials and API keys stored on or managed by GMS if compromise is suspected

Patch Information

SonicWall has published fixed versions and remediation guidance in advisory SNWLID-2026-0011. Administrators should consult the SonicWall PSIRT advisory for the exact fixed build numbers applicable to their deployment and apply the vendor-supplied update following standard change management procedures.

Workarounds

Place the GMS Dispatcher Service behind a firewall or VPN and permit only administrator source addresses
Disable or block external exposure of the Dispatcher Service port until patching is complete
Deploy network intrusion prevention signatures that inspect Dispatcher Service traffic for command injection patterns

bash

# Example: restrict access to the GMS Dispatcher Service to a management subnet
# Replace <DISPATCHER_PORT> and <MGMT_SUBNET> with values for your environment
iptables -A INPUT -p tcp --dport <DISPATCHER_PORT> -s <MGMT_SUBNET> -j ACCEPT
iptables -A INPUT -p tcp --dport <DISPATCHER_PORT> -j DROP