ACSC Warns Of SonicWall SSL VPN Exploit (CVE-2024-40766)

## Executive summary The Australian Cyber Security Centre (ACSC) and SonicWall warn of active exploitation of CVE-2024-40766 — a critical access-control bypass in SonicWall SSL VPN appliances (CVSS 9.3) — being used in the wild, including by actors deploying Akira ransomware; affected Gen5–Gen7 devices require urgent firmware updates, credential resets, MFA and access hardening, and organizations should apply provided mitigations and block identified IoCs immediately.