Quick answers
- Is CVE-2026-66152 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66152 being exploited in the wild.
- How severe is CVE-2026-66152?
- High severity, with a CVSS score of 8.8, published 25 August 2026.
- Which products and versions are affected?
- SonicWall NetExtender Linux client.
- Is there a fix for CVE-2026-66152?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-66152 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-66152?
- Check whether you run SonicWall NetExtender Linux client. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a path traversal flaw in the NetExtender Linux client's file extractor component. An attacker can exploit this to write arbitrary files to any location on the system with root privileges by crafting malicious input that bypasses path validation. The attack is network-reachable and does not require user authentication beyond initial NetExtender access. Successful exploitation allows arbitrary code execution with root-level privileges, enabling complete system takeover. Patches are expected from SonicWall.
Affected products
- SonicWall NetExtender Linux client
Timeline
- 2026-08-25: disclosed