ThreatCluster

SonicWall NetExtender Vulnerabilities Enable Root File Writes

First seen 26 Aug 2026, 17:36 UTC • •71

Article Content

1 / 3

Browse articles

ThreatCluster •August 27, 2026 at 17:18 UTC

•Two critical vulnerabilities in SonicWall NetExtender allow root file writes.
•CVE-2026-66152 has a CVSS score of 8.8/10 and affects versions 10.3.5 and earlier.
•Users must upgrade to version 10.3.6 or later to mitigate these vulnerabilities.

SonicWall has disclosed two critical vulnerabilities in its NetExtender Linux Client, allowing attackers to write arbitrary files with root privileges. The vulnerabilities affect versions 10.3.5 and earlier, with the most severe issue tracked as CVE-2026-66152, which has a CVSS score of 8.8/10. SonicWall released a patch in version 10.3.6 to address these issues. The vulnerabilities could potentially lead to significant unauthorized access and control over affected systems. Users are urged to upgrade to the latest version to mitigate risks. The vulnerabilities were published on August 25, 2026, and are now publicly known. Organizations using the affected versions should take immediate action to secure their systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 45d ago How this analysis works

Timeline

2026-08-25

CVE-2026-66152 published

SonicWall disclosed a critical path traversal vulnerability in NetExtender Linux Client.

Cybersecuritynews

2026-08-26

SonicWall releases security updates

SonicWall released version 10.3.6 to address the vulnerabilities affecting earlier versions.

More articles in this cluster (2)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Organization (1)

Sonicwall

Vulnerability (1)

CVE-2026-66152

Weakness (1)

CWE-22 - Path Traversal

Affected Platform (1)

Linux

Relationships

CVE-2026-66152 targets Linux
Zero-day Exploit targets Linux
T1068 - Exploitation for Privilege Escalation targets Linux
CVE-2026-66152 related to Sonicwall
CVE-2026-66152 related to CWE-22 - Path Traversal

Following this threat?

Track Sonicwall and CVE-2026-66152 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…