CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration., (Tue, Jun 23rd)

SonicWall disclosed CVE-2024-40766 (CVSS 9.3) affecting SSLVPN across Gen 5–7 appliances; despite patches, Akira and Fog ransomware operators and other attackers exploited patched devices through stale local accounts, overpermissive LDAP defaults, exposed Virtual Office Portals, and a MySonicWall backup compromise that leaked encrypted credentials, while a separate MFA bypass (CVE-2024-12802) and Gen 6 end-of-life further amplify risk — the report provides forensic indicators, detection rules, and a post-patch hardening checklist emphasizing account rotation, LDAP reconfiguration, portal access restriction, session termination, and upgrading to SonicOS 7.3.0+.