CVE-2026-66145
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.
Risk Assessment
The risk includes unauthorized access to sensitive data and the ability to write malicious files on the server, potentially leading to system compromise.
Recommendation
It is recommended to immediately update GMS to a patched version and implement file integrity monitoring and log auditing.
Other vulnerabilities in GMS
See all- CVE-2026-18634High
An insecure handling of serialized objects vulnerability was found in one of the services of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component.
- CVE-2026-66146Medium
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.
Original NVD description (English source)
An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS