CVE-2026-66145: SonicWall GMS Unauthenticated Remote Code Execution via Zip Slip - What It Means for Your Business and How to Respond

Introduction

A critical vulnerability in SonicWall Global Management System (GMS) places organizations that still rely on this platform at serious risk. CVE-2026-66145 allows remote attackers with no credentials to write arbitrary files and access sensitive data on affected systems. Because GMS serves as a central management console for firewalls and related security devices across many networks in the United States and Canada, a successful attack can cascade beyond a single appliance. Businesses of all sizes that have not yet migrated away from older GMS deployments face potential disruption to security operations, exposure of configuration data, and downstream effects on the networks those appliances protect. This post explains the business implications of the flaw, outlines practical ways to determine whether your environment is exposed, and provides clear next steps so decision-makers can respond effectively without needing deep technical expertise.

S1 — Background & History

SonicWall disclosed CVE-2026-66145 on August 11, 2026, as part of advisory SNWLID-2026-0011. The vulnerability affects SonicWall Global Management System (GMS) Virtual Appliance and Windows installations running version 9.5.1 (Build 9510.1044), including 9.5.1-SP1, and all earlier releases. Security researcher Richard Warren of AmberWolf reported the issue. The Common Vulnerability Scoring System rates it 9.1 Critical. In plain language, the flaw is an unauthenticated remote code execution weakness that stems from improper handling of ZIP archive file paths, commonly called a zip-slip condition. An attacker can supply a specially crafted archive that forces the system to write files outside the intended directory and read sensitive data. Key timeline points include reservation of the CVE identifier in late July 2026, public disclosure and vendor advisory release on August 11, 2026, and availability of the fixed release 9.5.2 shortly thereafter. GMS itself had already been marked for retirement, with support scheduled to end on September 30, 2026, increasing the urgency for remaining users.

S2 — What This Means for Your Business

If your organization still operates an unpatched SonicWall GMS instance, the practical risk is straightforward. An attacker who reaches the management interface can gain control of the system without any login. That control can expose firewall policies, device credentials, network maps, and other sensitive configuration data. From a compromised management console an adversary may alter security rules, disable protections, or use the platform as a foothold to reach other systems. Operational continuity suffers when security teams lose confidence in the tools that manage perimeter defenses. Reputation damage follows if customer or partner data is exposed or if network outages become public. Compliance obligations under frameworks common in the United States and Canada, such as those governing financial services, healthcare, or critical infrastructure, can be violated when management systems are left vulnerable to unauthenticated remote compromise. Even organizations that plan to migrate away from GMS still carry residual risk until the existing instance is either upgraded or fully decommissioned and replaced.

S3 — Real-World Examples

Regional bank management console exposure: A mid-sized regional bank continues to use an older GMS instance to oversee branch firewalls. An unauthenticated attacker reaches the interface, writes malicious files, and extracts stored credentials. The bank must then conduct an emergency review of all firewall policies and rotate credentials across dozens of locations, interrupting normal security operations and triggering regulatory notification requirements.

Healthcare network management disruption: A multi-clinic healthcare provider relies on GMS for centralized monitoring of network security devices. Successful exploitation allows an attacker to read sensitive configuration data and potentially modify rules. Clinical systems that depend on those network protections face elevated risk, and the organization must divert IT resources to containment while ensuring patient data pathways remain intact.

Manufacturing plant security oversight: A manufacturing company with several facilities uses GMS to manage industrial network gateways. Compromise of the console could let an attacker alter access controls or extract credentials for connected systems. Production lines that depend on stable network segmentation experience heightened downtime risk and potential safety implications if security monitoring is degraded.

Municipal IT shared services: A mid-sized Canadian municipality runs GMS to administer firewalls across city departments. An external attacker exploits the vulnerability, obtains sensitive management data, and forces an unplanned isolation of the console. Public-facing services and internal administrative networks require temporary compensatory controls while the municipality accelerates its migration plan.

S4 — Am I Affected?

• You are running SonicWall GMS Virtual Appliance or Windows version 9.5.1 (including 9.5.1-SP1, Build 9510.1044) or any earlier release.
• Your GMS management interface is reachable from untrusted networks or the public internet.
• You have not yet upgraded to version 9.5.2 or higher.
• You still rely on GMS for centralized management, monitoring, or reporting of SonicWall devices rather than having fully migrated to a supported alternative.
• Your asset inventory or vulnerability scans list an affected GMS build.
• You have not confirmed that the installation has been decommissioned and removed from the network.

If any of the above statements apply, treat the system as potentially vulnerable until verified otherwise.

Key Takeaways

• CVE-2026-66145 is a critical unauthenticated vulnerability in older SonicWall GMS versions that enables remote file write and sensitive data access.
• Organizations still operating unpatched GMS instances face direct risk to security operations, data confidentiality, and regulatory compliance.
• Real-world impact can extend from a single management console to the broader network devices it controls across banking, healthcare, manufacturing, and public-sector environments.
• Immediate verification of version and network exposure is the fastest way for business leaders to determine personal exposure.
• Upgrading to the fixed release or completing migration away from GMS remains the definitive path to eliminating the risk.

Call to Action

Do not leave legacy management platforms as an open door. Contact IntegSec today for a focused penetration test and comprehensive cybersecurity risk assessment that identifies remaining SonicWall GMS exposure and quantifies residual risk across your environment. Our team delivers clear, actionable findings so you can close gaps efficiently and strengthen overall defenses. Visit https://integsec.com to schedule a conversation and move from uncertainty to measurable risk reduction.

TECHNICAL APPENDIX (security engineers, pentesters, IT professionals only)

A — Technical Analysis

The root cause is insufficient validation of file paths contained inside ZIP archives processed by SonicWall GMS. When an unauthenticated attacker uploads or otherwise supplies a malicious archive, path traversal sequences (zip-slip) allow files to be written outside the intended extraction directory. The same mechanism can be leveraged to read sensitive data residing on the system. The affected component is the archive handling logic within GMS versions up to and including 9.5.1 Build 9510.1044 on both Virtual Appliance and Windows platforms. Attack vector is network, attack complexity is low, privileges required are none, and user interaction is none. CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code / Code Injection). Official references appear in the NVD entry for CVE-2026-66145 and SonicWall advisory SNWLID-2026-0011.

B — Detection & Verification

Version enumeration can be performed through the GMS administrative interface under system information or by examining the build string reported by the appliance. Network scanners that fingerprint SonicWall management services can identify exposed instances and correlate version data when available. Log indicators include unexpected ZIP processing activity, file creation events outside normal GMS directories, or anomalous unauthenticated requests targeting archive-related endpoints. Behavioral anomalies may appear as sudden creation of files with suspicious names or locations, unexpected process spawning after archive handling, or unusual outbound connections originating from the GMS host. Network exploitation indicators include inbound connections to the GMS management port that deliver multipart or archive payloads without prior authentication, followed by subsequent file-system changes or credential access patterns.

C — Mitigation & Remediation

1. Immediate (0–24h): Isolate the GMS management interface from untrusted networks by applying firewall rules or network segmentation so that only authorized administrative hosts can reach it. Confirm the exact version and document current exposure.
2. Short-term (1–7d): Apply the official vendor patch by upgrading to GMS 9.5.2 or higher, available through mysonicwall.com. After upgrade, verify system integrity, review access controls, and examine logs for signs of prior exploitation. If immediate upgrade is impossible, maintain strict network isolation and disable any unnecessary archive upload or import features.
3. Long-term (ongoing): Complete migration from the end-of-life GMS platform to a supported management solution. Implement continuous vulnerability scanning of remaining management interfaces, enforce least-privilege network access, and maintain an accurate inventory of all security management systems so that future disclosures can be triaged quickly. Official vendor guidance prioritizes the 9.5.2 upgrade as the primary remediation.

D — Best Practices

• Restrict management interfaces of security appliances to dedicated administrative networks only and never expose them to the public internet.
• Maintain rigorous input validation and path sanitization for any archive or file-upload functionality within management platforms.
• Treat end-of-life management systems as high-priority migration targets and schedule their decommissioning before support windows close.
• Monitor file-system integrity on management hosts for unexpected writes outside authorized directories.
• Include centralized security management consoles in regular penetration testing scope so that unauthenticated remote flaws are discovered before public disclosure