SonicWall SSLVPN access control flaw is now exploited in attacks

SonicWall has issued an urgent advisory for CVE-2024-40766, a critical (CVSS 9.3) access-control flaw in SonicOS affecting Gen5/6/7 devices including SSLVPN; administrators are urged to apply vendor patches and mitigations (restrict management access, disable or limit SSLVPN, enforce MFA and password resets). The vendor reports potential exploitation in the wild and security firms have observed Akira ransomware campaigns targeting this vulnerability.