CVE-2026-66145

This vulnerability lets a stranger on the internet talk to your gms system and take control of it—without creating an account first. Think of it like leaving a door unlocked and also allowing the caller to reach inside, copy sensitive information, and change what’s on your system. Once an attacker has that access, they can often install malware or disrupt your business operations.

This matters if your business uses or hosts gms, and your gms service is exposed over the network (the findings say it is reachable in the default configuration). It does not require an attacker to have an account, and there is no user action needed once the attacker can reach the service.

This is RED because attackers can exploit it remotely without credentials, and it grants the ability to run harmful commands on the server. New reporting ties it to advanced activity (actor: Lazarus Group), so you should assume the risk is active and prioritize containment and investigation immediately.

1. Confirm whether you are affected

• Identify the exact gms version/build currently installed.
• Consider you affected if you are on GMS 9.5.1 (Build 9510.1044) or earlier.

2. Confirm exposure (this is critical)

• Determine whether the gms service is reachable from the public internet.
• In cloud or hosted environments, check security groups/firewall rules and any reverse proxy routing.

3. Contain immediately if exposed

• If the service is internet-reachable, block inbound access to the gms service from the public internet.
• Allow only from trusted admin networks (for example, your office IPs/VPN ranges) and restrict admin access as much as possible.

4. Patch/upgrade status

• The findings state: no fix/patch information is available.
• If your vendor provides an update, upgrade to the fixed version immediately.
• If no fixed version is available, coordinate with your IT/vendor on the most practical risk-reduction path (typically network isolation + compensating controls) until an official fix is released.

5. Threat hunting / what to watch

• Review gms access and application logs around the last days/weeks for unusual requests to gms endpoints.
• Look for signs of unauthorized file creation/overwriting or unexpected outbound activity from the server (common post-exploitation behavior).

6. Validate after changes

• After firewall/routing changes, verify the service is no longer reachable from the internet.
• Re-check logs to confirm blocked traffic and look for any remaining abnormal activity.

Severity is critical (attackers have remote, unauthenticated access) with a weakness consistent with command execution (CWE-94). The attack mechanism described in the findings is unauthorized remote code execution over the network without authentication or user interaction, which can also lead to sensitive data access and creation/overwrite of files. The press/exploitation reporting is not clear on a dated, confirmed public exploitation claim, and there is no public exploit code recorded. KEV is not listed in CISA KEV. Patch availability is not known from the provided findings (no confirmed fixed version information yet). EPSS is only a prediction and is not used as the decision driver here given the confirmed advanced activity context (actor: Lazarus Group).