GMS Virtual Appliance Multiple Vulnerabilities (RCE/Command Injection/Cert Bypass)

Vulnerability Overview Vulnerability ID: SNVLD-2026-0011 First Published: 2026-09-11 Last Updated: 2026-08-11 Status: Applicable CVE Numbers: CVE-2026-66145, CVE-2026-66146, CVE-2026-66147, CVE-2026-66148 CVE Score: 9.4 CVSS v3: 9.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Scope Affected Product: GMS - Virtual Appliance and Windows Affected Versions: 9.5.1 and earlier Remediation Fixed Product: GMS - Virtual Appliance and Windows Fixed Version: 9.5.2 Vulnerability Details 1. CVE-2026-66145: Unauthorized Remote Code Execution Vulnerability - Description: An unauthorized remote code execution vulnerability was discovered in GMS 9.5.1 (Build 9510.1044) and earlier versions, allowing remote attackers to read sensitive data and perform arbitrary file write operations. - CVSS Score: 9.1 - CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: Improper Control of Generation of Code ('Code Injection') (CWE-94) 2. CVE-2026-66146: Multiple Cross-Site Scripting (XSS) Vulnerabilities in GMS - Description: Multiple cross-site scripting (XSS) vulnerabilities were discovered in GMS 9.5.1 (Build 9510.1044) and earlier versions, allowing remote attackers to execute JavaScript scripts in the user's browser. - CVSS Score: 9.0 - CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - CWE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79) 3. CVE-2026-66147: Unauthorized Command Injection in GMS Dispatcher Service - Description: An unauthorized command injection vulnerability was discovered in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions, allowing remote attackers to execute remote code through specially crafted requests. - CVSS Score: 9.4 - CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: Improper Control of Generation of Code ('Code Injection') (CWE-94) 4. CVE-2026-66148: GMS Local Privilege Execution via Authorized Command Injection - Description: An authorized command injection vulnerability was discovered in the GMS Command Line Interface (CLI) in GMS 9.5.1 (Build 9510.1044) and earlier versions, allowing low-privilege local users to execute system commands with root privileges. - CVSS Score: 6.3 - CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CWE: Improper Control of Generation of Code ('Code Injection') (CWE-94) 5. CVE-2026-66154: GMS Certificate Validation Bypass via HTM - Description: A certificate validation bypass vulnerability was discovered in GMS 9.5.1 (Build 9510.1044) and earlier versions. Under successful MMI attack conditions and restricted network conditions, this could lead to unauthorized changes. - CVSS Score: 8.3 - CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: Improper Certificate Validation (CWE-296) 6. CVE-2026-18634: GMS Local Privilege Execution via Disauthorization - Description: A disauthorization vulnerability was discovered in GMS 9.5.1 (Build 9510.1044) and earlier versions, allowing low-privilege local users to execute system commands with root privileges. - CVSS Score: 6.3 - CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CWE: Improper Control of Generation of Code ('Code Injection') (CWE-94) References CVE-2026-66145: Richard Wannam of AmberWolf CVE-2026-66146: Brian Mariani CVE-2026-66147: Matei Badarau of Pentest-Tools.com - PTT-2026-009 CVE-2026-66148: Brian Mariani through ZDI (Zero Day Initiative) - Tendy Moco - ZDI-CAN-29024 CVE-2026-66154: Matei Badarau of Pentest-Tools.com - PTT-2026-010 CVE-2026-18634: Matei Badarau of Pentest-Tools.com - PTT-2026-011 Revision History Version: 1.0 Date: 11-Aug-2026 Description: Initial Release References CVE-2026-66145: Richard Wannam of AmberWolf CVE-2026-66146: Brian Mariani CVE-2026-66147: Matei Badarau of Pentest-Tools.com - PTT-2026-009 CVE-2026-66148: Brian Mariani through ZDI (Zero Day Initiative) - Tendy Moco - ZDI-CAN-29024 CVE-2026-66154: Matei Badarau of Pentest-Tools.com - PTT-2026-010 CVE-2026-18634: Matei Badarau of Pentest-Tools.com - PTT-2026-011 Remediation Fixed Product: GMS - Virtual Appliance and Windows Fixed Version: 9.5.2 References CVE-2026-66145: Richard Wannam of AmberWolf CVE-2026-66146: Brian Mariani CVE-2026-66147: Matei Badarau of Pentest-Tools.com - PTT-2026-009 CVE-2026-66148: Brian Mariani through ZDI (Zero Day Initiative) - Tendy Moco - ZDI-CAN-29024 CVE-2026-66154: Matei Badarau of Pentest-Tools.com - PTT-2026-010 CVE-2026-18634: Matei Badarau of Pentest-Tools.com - PTT-2026-011 References CVE-2026-66145: Richard Wannam of AmberWolf CVE-2026-66146: Brian Mariani CVE-2026-66147: Matei Badarau of Pentest-Tools.com - PTT-2026-009 CVE-2026-66148: Brian Mariani through ZDI (Zero Day Initiative) - Tendy Moco - ZDI-CAN-29024 CVE-2026-66154: Matei Badarau of Pentest-Tools.com - PTT-2026-010 CVE-2026-18634: Matei Badarau of Pentest-Tools.com - PTT-2026-011 References CVE-2026-66145: Richard Wannam of AmberWolf CVE-2026-66146: Brian Mariani CVE-2026-66147: Matei Badarau

Goal Reached Thanks to every supporter — we hit 100%!

GMS Virtual Appliance Multiple Vulnerabilities (RCE/Command Injection/Cert Bypass)