CVE-2024-40766
SonicWall SonicOS Improper Access Control Vulnerability
- Critical 9.3
- Exploited: added to CISA KEV 9 Sep 2024
- Used in ransomware campaigns
Description
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
Key facts
- Published
- 23 Aug 2024
- Last changed
- 21 Sep 2026
- Assigned by
- sonicwall
- KEV added
- 9 Sep 2024
- KEV fix due
- 30 Sep 2024
- Used in ransomware
- Yes, according to CISA
- EPSS
- 18.379% likely to be exploited in the next 30 days, higher than 97.277% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: active; Automatable: yes; Technical impact: partial
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 9.3CVSS 3.1, Criticalfrom CISA (ADP container)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SonicWall | SonicOS |
|
Timeline
- 23 Aug 2024 Published
- 9 Sep 2024 Added to the CISA KEV catalogue