Article
Akira ransomware advisory AA24-109A: stages and tools
CISA and partners say Akira enters through VPNs without MFA and known CVEs, steals data, then encrypts. A read of advisory AA24-109A, updated Nov…
Read more
Exploited vulnerability
SonicWall SonicOS access control flaw (CVE-2024-40766)
CVE-2024-40766
CVE-2024-40766 is an access control flaw in SonicOS, the software on SonicWall firewalls.
- On CISA KEV
- CVE ID
- CVE-2024-40766
- CISA KEV
- Listed
- Affected product
- SonicOS
- Exploited
- Yes
- Published
- August 2024
In short
CVE-2024-40766 is an access control flaw in SonicOS, the software on SonicWall firewalls. Per CISA, it can give an attacker access to resources they should not reach and can crash the firewall. CISA, the FBI and partners say Akira ransomware actors used it to get in.
- CVECVE-2024-40766
- ProductSonicWall SonicOS
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listed
What it allows
Improper access control means the system fails to check who is allowed to do what. NVD says the flaw is in SonicOS management access and can lead to unauthorized resource access. In specific conditions it can make the firewall crash. A firewall sits at the edge of the network, so a break here can expose everything behind it.
Who is affected
NVD says it affects SonicWall Gen 5 and Gen 6 firewalls, and Gen 7 firewalls running SonicOS 7.0.1-5035 and older. Check the vendor's own security advisory (SNWLID-2024-0015) for the fixed builds, because this page could not open that page.
NVD published the record in August 2024 (23 August). CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 9 September 2024, and the KEV entry flags known use in ransomware campaigns.
In the joint #StopRansomware advisory on Akira (AA24-109A, last revised 13 November 2025), CISA, the FBI and partners list CVE-2024-40766 among the flaws they observed Akira actors using for initial access. The advisory says Akira often gets in through a VPN service that has no multifactor authentication set up.
Who exploits it
What to do
-
Apply the vendor's fix or mitigation
The KEV entry says to apply mitigations per vendor instructions, or stop using the product if none are available. Use the fixed SonicOS builds in the vendor advisory SNWLID-2024-0015.
-
Put multifactor authentication on every VPN account
The Akira advisory says the group gets in through VPN services that have no MFA configured, so turn it on for all remote access.
-
Remediate known exploited flaws first
The Akira advisory puts this first in its list of actions: prioritize fixing known exploited vulnerabilities, and the KEV catalog is the list to work from.
-
Review who can reach the firewall's management
NVD places the flaw in management access, so keep it off the open internet where you can. This follows from the flaw's location and is not quoted from the advisories.
-
Treat unexplained firewall access or crashes as a warning
CISA says the flaw can crash a firewall. Investigate unexpected crashes and unknown accounts as possible signs of an attack.
Questions
What is CVE-2024-40766?
CVE-2024-40766 is an improper access control flaw (CWE-284) in SonicOS, the software on SonicWall firewalls. NVD says it sits in management access and can lead to unauthorized resource access. In specific conditions it can make the firewall crash.
Is CVE-2024-40766 being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 9 September 2024, and the entry flags known use in ransomware campaigns. The joint advisory on Akira (AA24-109A) lists it among the flaws Akira actors used for initial access.
Which SonicWall firewalls are affected by CVE-2024-40766?
NVD says it affects SonicWall Gen 5 and Gen 6 firewalls, and Gen 7 firewalls running SonicOS 7.0.1-5035 and older. Check the vendor advisory SNWLID-2024-0015 for the fixed builds.
How do I defend against CVE-2024-40766?
Apply the vendor's fix or mitigation, and put multifactor authentication on every VPN account, because Akira often gets in through VPN services without MFA. Fix known exploited flaws first, and keep firewall management off the open internet where you can.
In our research
Sources
- CVE-2024-40766 record NIST NVD
- Known Exploited Vulnerabilities catalog (JSON feed) CISA
- #StopRansomware: Akira Ransomware (AA24-109A) CISA, FBI, DC3, HHS and international partners
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.