CVE-2026-66147

This vulnerability lets someone send a specially made network message to your server and trick it into running commands of their choice. Think of it like leaving a remote “send instructions” door open without a lock—if someone reaches it, they may be able to take control of what the server does.

This matters if your business runs SonicWall GMS (specifically the GMS Dispatcher Service) at version 9.5.1 or older. Because the issue is unauthenticated, it does not require an account or a user clicking anything—an attacker only needs network reachability to the service. The real risk is primarily if the Dispatcher Service is reachable from the internet or otherwise accessible from untrusted networks.

This is RED because attackers can remotely trigger command execution without authentication, which is the kind of bug that leads to full server compromise. While there is no confirmed evidence in the provided reporting that it’s exploited in the wild, this still requires immediate containment steps because the impact (code execution) is severe.

1. Confirm installation and version

   • Identify whether SonicWall GMS Dispatcher Service is installed and running.
   • Verify the deployed version. If it is 9.5.1 or earlier, you are in the affected range described.

2. Confirm reachability (the key exposure gate)

   • Check whether the Dispatcher Service port/endpoints are exposed beyond your trusted internal network.
   • Validate from an external network perspective (or via firewall logs) whether it can be reached from the internet.

3. Immediate mitigation while waiting for an official fix

   • Restrict access: block inbound traffic to the Dispatcher Service from the public internet and any untrusted networks.
   • Allowlist only trusted admin systems/VPN networks, if needed for business operations.
   • Ensure the service is not reachable from locations you cannot control.

4. Remediation/upgrade

   • The available information does not include a specific fixed version or patch package, so you should work with SonicWall support or your vendor/IT provider to obtain the official upgrade/remediation guidance.
   • Plan an upgrade test in a staging environment first, then roll out to production with an expected maintenance window.

5. What to monitor

   • Network/firewall logs for inbound attempts to the Dispatcher Service.
   • Server logs for unusual command execution behavior, unexpected process launches, or repeated malformed requests.
   • Any alerts tied to GMS Dispatcher Service request handling anomalies.

6. Timing note

   • No CISA KEV listing was found in the provided information, and there is no dated public exploitation claim. Still, because the vulnerability is unauthenticated with remote code execution impact, treat it as urgent for containment and upgrade planning.

Severity is critical in impact: this is unauthenticated command injection (CWE-94) in the GMS Dispatcher Service. The mechanism is that a remote attacker can send specially crafted network requests that cause the service to execute arbitrary commands on the host, without requiring any account and without user interaction.

Exploitation status in the provided findings: not listed in CISA KEV, no clear dated evidence of exploitation in the press, and no public exploit code is on record. The traffic-light verdict is RED per this case’s assessment.

Exploit maturity: no public exploit code has been identified in the findings, and KEV does not list the issue—however, the weakness type and unauthenticated remote code execution mean it warrants immediate exposure reduction.

EPSS: a prediction is provided (flat trend) but is not used to justify urgency in public-facing guidance because the decisive risk comes from the unauthenticated remote code execution capability.