[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGHC2ws6uYcxHpZt17UKWY05E2hxKv1r6O0YFxU66XAg":3},{"article":4,"iocs":43,"watch_terms":55,"solutions":56,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"0ebe4902-9b22-42d2-9f03-a92d9f780589","SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform","sonicwall-patches-critical-vulnerabilities-in-discontinued-gms-platform-85afa6","The security defects could allow unauthenticated attackers to execute arbitrary code remotely and read sensitive data. The post SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform appeared first on SecurityWeek.","SonicWall has released patches for eight vulnerabilities affecting its Global Management System (GMS) and Email Security products. Two critical RCE vulnerabilities in GMS, CVE-2026-66147 and CVE-2026-66145, could allow unauthenticated attackers to execute arbitrary code and disclose sensitive data. Additionally, two high-severity code injection flaws in Email Security, CVE-2026-66149 and CVE-2026-66150, could lead to OS command execution.","SonicWall patches critical RCE vulnerabilities in discontinued GMS and Email Security platforms.","https:\u002F\u002Fwww.securityweek.com\u002Fsonicwall-patches-critical-vulnerabilities-in-discontinued-gms-platform\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F08\u002FSonicWall.jpg","2026-08-12T07:31:11+00:00","2026-08-12T08:00:24.601503+00:00",8,[17,20,22],{"name":18,"type":19},"Global Management System (GMS)","product",{"name":21,"type":19},"Email Security",{"name":23,"type":24},"SonicWall","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,50,53],{"type":45,"value":46,"context":47},"cve","CVE-2026-66147","Critical RCE vulnerability in SonicWall GMS",{"type":45,"value":49,"context":47},"CVE-2026-66145",{"type":45,"value":51,"context":52},"CVE-2026-66149","High-severity code injection vulnerability in SonicWall Email Security",{"type":45,"value":54,"context":52},"CVE-2026-66150",[23,18],{"controls":57,"vendors":137},[58,87,112],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,104],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":88,"product_name":101,"url":102,"description":103},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":113,"name":114,"problem":115,"products":116},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[117,125,132],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":127,"url":130,"description":131},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":133,"product_name":134,"url":135,"description":136},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",[138],{"slug":139,"name":23,"logo_path":140,"roles":141},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[142],"affected",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":158},"critical-rce-flaws-in-sonicwall-gms-demand-immediate-patching","Critical RCE Flaws in SonicWall GMS Demand Immediate Patching","SonicWall disclosed eight vulnerabilities in its Global Management System (GMS) and Email Security products, including two critical unauthenticated remote code execution (RCE) flaws that expose organizations to full system compromise without any credentials required. The risk is compounded by the fact that GMS is a discontinued platform, meaning organizations running legacy or end-of-life software face an elevated threat surface with limited vendor support going forward. Unauthenticated RCE vulnerabilities are among the most severe possible findings, as attackers can exploit them at scale with no prior foothold. This incident underscores the danger of retaining end-of-life network management infrastructure in production environments, where timely patching may not always be feasible or guaranteed.",[148,149,150,151,152,153,154,155,156,157],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SA-22: Unsupported System Components","NIST SC-7: Boundary Protection","NIST RA-5: Vulnerability Monitoring and Scanning","ITIL Change Management: Emergency Change Procedures","GDPR Article 32: Security of Processing (for EU data controllers using affected systems)",{}]