CVE-2024-40766
Published 2024-08-23 · Updated 2026-09-21 · Source PSIRT@sonicwall.com
Summary
CVE-2024-40766 is a critical-severity (CVSS 9.8) vulnerability in SonicWall SonicOS. CISA added it to the Known Exploited Vulnerabilities catalog on September 9, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 30, 2024. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. SonicWall has 20 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.
All 20 known-exploited SonicWall vulnerabilities →Description
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: SonicWall — SonicOS
Name: SonicWall SonicOS Improper Access Control Vulnerability
Date added: 2024-09-09 · Due: 2024-09-30
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.