CVE-2024-40766

9.8 criticalKEVEPSS 18%

Critical (9.8) in SonicWall SonicOS. In CISA KEV since 2024-09-09, with known ransomware use. EPSS 18% chance of exploitation in the next 30 days.

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 18% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2024-09-09, due 2024-09-30, known ransomware use
CWE: CWE-284
Published: 2024-08-23
Modified: 2026-09-21
Record from: the NVD, synced 2026-10-19

Affected

sonicwall:sonicos

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766

Check your stack JSON