Akira Ransomware exploits year-old SonicWall flaw with multiple vectors

Researchers warn that the Akira ransomware group is exploiting a year-old SonicWall firewall flaw, likely using three attack vectors for initial access, according to Rapid7. The vulnerability, tracked as CVE-2024-40766, carries a CVSS score of 9.3 and resides in the SonicWall SonicOS management access. SonicWall addressed the flaw in August 2024, and the US CISA added it to its Known Exploited Vulnerabilities catalog in September 2024.

In August 2025, SonicWall investigated claims of a zero-day being used in ransomware attacks but found no evidence of any new vulnerability in its products, stating there is high confidence the activity is not connected to a zero-day and is correlated with CVE-2024-40766. The advisory notes fewer than 40 related incidents, many tied to migrations from Gen 6 to Gen 7 firewalls where local passwords were not reset, with resetting passwords highlighted as a critical step. Evidence suggests Akira is exploiting a mix of these flaws and attackers may still access systems if credentials weren’t changed.