CVE-2026-66145

This vulnerability lets a stranger on the internet talk to your gms system and take control of it—without creating an account first. Think of it like leaving a door unlocked and also allowing the caller to reach inside, copy sensitive information, and change what’s on your system. Once an attacker has that access, they can often install malware or disrupt your business operations.

This matters if your business uses or hosts gms, and your gms service is exposed over the network (the findings say it is reachable in the default configuration). It does not require an attacker to have an account, and there is no user action needed once the attacker can reach the service.

This is RED because attackers can exploit it remotely without credentials, and it grants the ability to run harmful commands on the server. New reporting ties it to advanced activity (actor: Lazarus Group), so you should assume the risk is active and prioritize containment and investigation immediately.