SonicWall Gms vulnerabilities

8 CVEs affecting SonicWall Gms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-66154, published 2026-08-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-66147, published 2026-08-11. Critical severity, CVSS 9.4. EPSS: 1.8% chance of exploitation in the next 30 days. An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through…
CVE-2026-66148, published 2026-08-11. Medium severity, CVSS 6.3. EPSS: 1.1% chance of exploitation in the next 30 days. An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute…
CVE-2024-29011, published 2024-05-01. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Use of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlier versions.
CVE-2026-66145, published 2026-08-11. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary…
CVE-2024-29010, published 2024-05-01. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information. This issue affects GMS:…
CVE-2026-18634, published 2026-08-11. High severity, CVSS 8.4. EPSS: 0.3% chance of exploitation in the next 30 days. An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to…
CVE-2026-66146, published 2026-08-11. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.
CVE-2026-66154, published 2026-08-11. High severity, CVSS 8.3. EPSS: 0.2% chance of exploitation in the next 30 days. An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack…