CVE-2026-66145CWE-94code-injection

CVE-2026-66145

Critical · published August 12, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
51.1
In the wild
Unconfirmed
What it is

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00664 · 51.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-12T00:18Z
References (1)
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011 · [email protected]
EPSS history
Timeline
  • 11 AUG 20:05Z
    An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read…
    cvelistv5