SonicWall CVE-2024-40766: SSLVPN Flaw Behind Akira Attacks

What to do

1. Check the SonicOS version on every firewall and upgrade Gen 7 to 7.3.0 or later and Gen 6 to at least 6.5.4.15.116n.
2. Force a password reset for every local SSLVPN account, especially accounts migrated from Gen 6, and rotate the LDAP bind credential.
3. Delete unused local accounts and require MFA, account lockout and Botnet Filtering for SSLVPN.
4. Point the LDAP SSLVPN default user group at a group with no access, and limit the Virtual Office Portal and management to trusted networks.
5. Replace end-of-life Gen 5 and Gen 6 units, or turn off SSLVPN and WAN management on them.

How to check if you are affected or compromised

• Review SSLVPN login events for logins from hosting or VPS providers instead of broadband ISPs, sessions over 24 hours, and accounts with no matching employee.
• Check logs for the IoC addresses in SNWLID-2024-0015, such as 88.119.175.104, 45.149.172.51 and 172.86.116.8.
• Look for TOTP enrollments nobody requested through the Virtual Office Portal.
• On internal hosts, hunt for new accounts like backupSQL or lockadmin, cloudflared.exe or OpenSSH in C:\ProgramData, and vssadmin shadow-copy deletion.

What happened#

On August 22, 2024, SonicWall published SNWLID-2024-0015 for CVE-2024-40766, an improper access control flaw in SonicOS management access that can grant unauthorized access or crash the firewall. On September 6 it added SSLVPN and warned of exploitation. CISA added it to KEV on September 9 and flags ransomware use. NVD scores it 9.8.

Arctic Wolf found Akira affiliates logging in through local SSLVPN accounts without MFA on vulnerable firmware. By October 2024 it counted at least 30 such intrusions, about 75% Akira and the rest Fog, BleepingComputer reported.

A second Akira wave began around July 22, 2025, seen by Arctic Wolf and Huntress. SonicWall's August 2025 notice said it was "not connected to a zero-day vulnerability" but correlated with CVE-2024-40766, with fewer than 40 incidents. Many involved Gen 6 to Gen 7 migrations whose local passwords were carried over and never reset. Rapid7 added two configuration risks: an LDAP SSLVPN default group that over-grants access, and a public Virtual Office Portal where a stolen password lets an attacker enroll their own TOTP device.

Who is affected#

Gen 5 SOHO on 5.9.2.14-12o or older (fixed in 5.9.2.14-13o), Gen 6 on 6.5.4.14-109n or older (fixed in 6.5.4.15.116n, or 6.5.2.8-2n for SM 9800 and NSsp 12400/12800), and Gen 7 on 7.0.1-5035 or older. SonicWall now recommends SonicOS 7.3.0, which adds brute-force protection. End-of-life Gen 5 units get no fix, and many Gen 6 models are out of support: TZ 400, TZ 600 and NSa 3600/3650 reached end of support on August 1, 2026, per SonicWall.

Do you really need to act?#

Patching did not invalidate stolen credentials. A Gen 6 configuration imported into Gen 7 brings its local passwords along, so a password taken from a vulnerable Gen 6 box still works on a patched Gen 7 box. A June 2026 SANS ISC audit of 14 patched firewalls found 11 had not rotated passwords and 9 mapped the LDAP default group to SSLVPN access; attackers, it says, "are scanning for patched firewalls where nobody completed the post-patch steps."

The verdict is check-exposure with one urgent group: if you migrated Gen 6 to Gen 7, or ran vulnerable firmware with SSLVPN exposed, and never reset local passwords, do it today. With current firmware, reset passwords and MFA, you are done.

What to do now#

1. Check firmware with show version in the SonicOS CLI. Move Gen 7 to 7.3.0 or later and Gen 6 to at least 6.5.4.15.116n.
2. Enable "User must change password" on every local SSLVPN account, or use SonicWall's bulk-change script. Rotate the LDAP bind password.
3. Delete unused local accounts; enable MFA, account lockout and Botnet Filtering.
4. Point the LDAP SSLVPN default group at a group with no access, limit the Virtual Office Portal and management to trusted networks, and confirm from outside with nmap -Pn -p 443,4433 <wan-ip>.
5. Replace end-of-life units, or disable SSLVPN and WAN management on them.

How to tell if you were hit#

Review SSLVPN login events. Arctic Wolf's main tell is logins from hosting or VPS providers instead of broadband ISPs; SANS adds sessions over 24 hours and accounts with no matching employee. Check for the advisory's IoC addresses, such as 88.119.175.104 and 45.149.172.51, and for TOTP enrollments nobody requested. Huntress saw Akira create accounts like backupSQL and lockadmin, stage cloudflared.exe and OpenSSH in C:\ProgramData, and run vssadmin delete shadows /all /quiet. Encryption can follow within hours, so any match means incident response.

Timeline#

• Aug 22, 2024 — SonicWall publishes SNWLID-2024-0015.
• Sep 9, 2024 — CISA adds the CVE to KEV.
• Jul 22, 2025 — Akira's second wave begins, Arctic Wolf says.
• Aug 4, 2025 — SonicWall's notice; by August 6 it blames this CVE and unreset passwords.
• Nov 13, 2025 — CISA and the FBI's updated Akira advisory names this CVE as an entry route.
• Jun 23, 2026 — SANS ISC finds patched firewalls still misconfigured.

Vulnerability records

• CVE-2024-40766 · KEV 2024-09-09 · An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. SonicWall PSIRT — SNWLID-2024-0015: SonicOS Improper Access Control Vulnerability psirt.global.sonicwall.com
2. SonicWall — Gen 7 and Newer SonicWall Firewalls: SSLVPN Recent Threat Activity sonicwall.com
3. SonicWall — Last Order Day of Support Announcement: TZ 400, TZ 400W, TZ 600, TZ 600P, NSA 3600, NSa 3650 sonicwall.com
4. CVE record — CVE-2024-40766 cve.org
5. NVD — CVE-2024-40766 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2024-40766 cisa.gov
7. Arctic Wolf — Arctic Wolf Observes Akira Ransomware Campaign Targeting SonicWall SSLVPN Accounts arcticwolf.com
8. Arctic Wolf — Arctic Wolf Observes July 2025 Uptick in Akira Ransomware Activity Targeting SonicWall SSL VPN arcticwolf.com
9. Huntress — Active Exploitation of SonicWall VPNs huntress.com
10. Rapid7 — Akira Ransomware Group Utilizing SonicWall Devices for Initial Access rapid7.com
11. CISA, FBI et al. — #StopRansomware: Akira Ransomware (AA24-109A, updated Nov 13, 2025) ic3.gov
12. SANS ISC — CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration. isc.sans.edu

Coverage and analysis

1. BleepingComputer — Fog ransomware targets SonicWall VPNs to breach corporate networks bleepingcomputer.com