CVE-2026-66147 in GMS
Summary
by MITRE • 08/11/2026
An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The identified vulnerability represents a critical command injection flaw within the GMS Dispatcher Service component of GMS software versions 9.5.1 and earlier. This security weakness exists in the service's handling of incoming requests without proper authentication mechanisms, creating an exploitable entry point for malicious actors. The vulnerability stems from insufficient input validation and sanitization processes that fail to properly filter or escape user-supplied data before it is processed by underlying system commands. Attackers can leverage this flaw by crafting specially designed requests that contain malicious command sequences, which then get executed within the context of the affected service.
The technical implementation of this vulnerability involves the improper handling of user-controllable parameters within the dispatcher service's request processing pipeline. When legitimate requests are received, the service does not adequately validate or sanitize input data, allowing attackers to inject arbitrary commands that are subsequently executed by the operating system. This type of flaw falls under the Common Weakness Enumeration category CWE-77, which specifically addresses command injection vulnerabilities where untrusted data is directly incorporated into command execution contexts without proper sanitization. The vulnerability exists because the service performs no authentication checks before processing incoming requests, making it accessible to any remote attacker without requiring valid credentials or access rights.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it enables complete remote code execution capabilities for attackers. Once exploited, malicious actors can execute arbitrary commands on the affected system with the privileges of the GMS service account, potentially leading to full system compromise. This allows attackers to escalate their privileges, install backdoors, exfiltrate sensitive data, or disrupt service availability entirely. The vulnerability affects organizations that rely on GMS 9.5.1 and earlier versions for their critical infrastructure operations, creating significant risk exposure across various operational domains including network monitoring, security event management, and system administration functions.
Organizations should implement immediate mitigation strategies to address this vulnerability through multiple layers of defense. The primary recommendation involves upgrading to GMS versions that contain patches addressing this command injection flaw, as vendors typically release security updates specifically targeting such vulnerabilities. Additionally, implementing network-level restrictions through firewalls and access control lists can help limit exposure by restricting direct access to the affected service ports and protocols. Security monitoring solutions should be configured to detect anomalous command execution patterns or unusual request patterns that may indicate exploitation attempts. The ATT&CK framework categorizes this type of vulnerability under T1059 - Command and Scripting Interpreter, where adversaries leverage system commands to achieve their objectives. Organizations should also consider implementing input validation controls at the application level, using parameterized queries and command execution wrappers that properly sanitize user inputs before processing. Regular security assessments and penetration testing should be conducted to verify that all systems have been properly updated and that no other similar vulnerabilities exist within the broader GMS deployment environment.