Vulnerability intelligence
CVE-2024-40766
SonicWall SonicOS Improper Access Control Vulnerability
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
CVSS Score
9.3
Critical
EPSS — Exploit Probability
18%
Riskier than 97% of all CVEs · checked 2026-09-16
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
Patch available
Federal deadline 2024-09-30
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2024-09-30.
1 article across 1 outlet · first covered Jun 23, 2026 · latest Jun 23, 2026
Associated threat actors
Coverage timeline
-
CVE-2024-40766 exposes SonicWall firewalls to ransomwareisc.sans.edu · Jun 23, 2026