---
id: "CVE-2024-40766"
kind: "vulnerability"
aliases: ["CVE-2024-40766"]
title: "An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "sonicwall sonicos", "fixed": ["5.9.2.14-13o"], "affected": "< 5.9.2.14-13o", "ecosystem": "vendor"}, {"name": "sonicwall sonicos", "fixed": ["6.5.2.8-2n"], "affected": "< 6.5.2.8-2n", "ecosystem": "vendor"}, {"name": "sonicwall sonicos", "fixed": ["6.5.4.15.116n"], "affected": "< 6.5.4.15.116n", "ecosystem": "vendor"}, {"name": "sonicwall sonicos", "fixed": [], "affected": "<= 7.0.1-5035", "ecosystem": "vendor"}, {"name": "SonicWall SonicOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "firewall", "infrastructure", "ransomware", "self-hosted", "sonicos", "sonicwall"]
not_affected_if: ["unknown"]
published_at: "2024-08-23T07:15:03+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-40766", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40766", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially…

SonicWall SonicOS firewalls contain an improper access control flaw that lets an attacker reach resources they should not, and can crash the firewall under certain conditions. CISA lists it as actively exploited in the wild, with ransomware use noted in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:sonicwall sonicos affected < 5.9.2.14-13o fixed 5.9.2.14-13o
- vendor:sonicwall sonicos affected < 6.5.2.8-2n fixed 6.5.2.8-2n
- vendor:sonicwall sonicos affected < 6.5.4.15.116n fixed 6.5.4.15.116n
- vendor:sonicwall sonicos affected <= 7.0.1-5035 fixed ?
- vendor:SonicWall SonicOS affected ? fixed ?

## Fix

Apply the vendor mitigation per SonicWall's advisory, or discontinue use of the product if mitigations are unavailable (per CISA required action). Fixed version: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-40766
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-40766

## From the sources

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_