SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform
SonicWall patches critical RCE vulnerabilities in discontinued GMS and Email Security platforms.
Summary
SonicWall has released patches for eight vulnerabilities affecting its Global Management System (GMS) and Email Security products. Two critical RCE vulnerabilities in GMS, CVE-2026-66147 and CVE-2026-66145, could allow unauthenticated attackers to execute arbitrary code and disclose sensitive data. Additionally, two high-severity code injection flaws in Email Security, CVE-2026-66149 and CVE-2026-66150, could lead to OS command execution.
Full text
SonicWall on Tuesday announced patches for eight vulnerabilities across two products, including critical-severity remote code execution (RCE) bugs. The cybersecurity firm rolled out fixes for six security defects in Global Management System (GMS), its centralized management, monitoring, and reporting platform that was retired in October 2025. Per SonicWall’s advisory, two of the flaws, namely CVE-2026-66147 (CVSS score of 9.4) and CVE-2026-66145 (CVSS score of 9.1), deserve special attention, as both could allow remote, unauthenticated attackers to execute arbitrary code. The former is described as a command injection issue in the GMS Dispatcher Service that can be exploited via crafted requests. The latter is an RCE bug leading to sensitive data disclosure and arbitrary file write via zipslip. Impacting the 9.5.1 and earlier versions of GMS (Virtual Appliance and Windows), the vulnerabilities were resolved in version 9.5.2 of the software. The update also addresses high-severity insufficient certificate validation and insecure handling of serialized objects bugs that could lead to unauthorized changes and actions.Advertisement. Scroll to continue reading. On Tuesday, SonicWall also rolled out fixes for two high-severity code injection flaws (CVE-2026-66149 and CVE-2026-66150) in Email Security that could lead to OS command execution with root privileges. Affecting ES Appliance 5000, 5050, 7000, 7050, 9000, VMware and Hyper-V, the two issues were resolved in Email Security version 10.0.36. SonicWall says it has no evidence that any of these vulnerabilities have been exploited in the wild but urges users to apply the patches as soon as possible. Additional information can be found on SonicWall’s security advisories page. Related: August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day Related: Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws Related: Cisco Patches Firewall Zero-Day Exploited for DoS Attacks Related: Zoom Patches Zero-Click Code Execution Vulnerability Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents BadMetabase Patches Vulnerability Exploited as Zero-DayCISA Urges Immediate Patching of Exploited Progress LoadMaster VulnerabilityCorporate Data Stolen in Levi Strauss CyberattackVishing Extortion Group UNC6671 Rebrands After Making MillionsMicrosoft, Apple Release Fresh Security Updates3.8 Million Impacted by Unlimited Technology Systems Data Breach Latest News ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix ContactCisco Patches Firewall Zero-Day Exploited for DoS AttacksAugust 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-DayAdobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic FlawsZoom Patches Zero-Click Code Execution VulnerabilityThe AI Governance Gap Is a Leadership Problem: Waiting Won’t Close ItSAP Patches Critical Code Injection, Memory Corruption VulnerabilitiesUS Water Systems Get Cyber Boost From New Senate Bill and ‘Water Watch Center’ Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move1Kosmos has named Frank Cohen Chief Revenue Officer.ServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email
Indicators of Compromise
- cve — CVE-2026-66147
- cve — CVE-2026-66145
- cve — CVE-2026-66149
- cve — CVE-2026-66150