CVE-2026-66147: exploitation status and patch state

CVE-2026-66147 · CVSS 9.4 CRITICAL

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.

Is CVE-2026-66147 exploited?

• Not in the CISA KEV catalog.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-66147

• SonicWall GMS RCEs Hit Retired Management Platform (2026-08-13)

Primary sources

• NVD record

What this record does not say

• No EPSS score.
• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-12.