CVE-2026-66148 is an authenticated command injection vulnerability affecting GMS CLI 9.5.1 (Build 9510.1044) and earlier versions. It permits a low-privileged local user to execute arbitrary system commands with root-level privileges. The vulnerability arises from improper handling of user input leading to command injection (CWE-94). The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impacts on confidentiality, integrity, and availability at a low level.

Exploitation of this vulnerability allows a low-privileged local user to escalate privileges to root by executing arbitrary system commands. This could lead to unauthorized system control, data modification, or service disruption. However, exploitation requires authenticated local access, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict local access to trusted users only and monitor for suspicious activity related to the GMS CLI. Avoid running the CLI on untrusted systems or with unnecessary privileges.