CVE-2024-40766Vulnerability

1. “…rity flaws in edge device products and internet-exposed products (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766) or, alternatively, credential exposure and brute-force password attacks, for initial access, followed by persistence, privilege esc…”

   The Hacker NewsNews22 Oct 2026
   ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More

2. “CVE-2024-40766 [CWE-284: Improper Access Control]”

   CISA advisoriesGovernment20 Oct 2026
   #StopRansomware: SafePay Ransomware

3. “Vulnerabilities in enterprise edge devices, such as in Citrix NetScaler ADC and Gateway (CVE-2025-5777), SonicWall SSL VPN (CVE-2024-40766) and Fortinet’s FortiOS (CVE-2024-55591) were among the most exploited by ransomware groups during the reported period.”

   Infosecurity MagazineNews27 Jul 2026
   Ransomware Groups Increasingly Deploy EDR Kill Techniques

4. “GreyNoise maintains CVE-specific detection tags for six of the seven CVEs below; CVE-2024-40766 does not currently have a detection tag.”

   GreyNoiseVendor27 Feb 2026
   Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure

5. “…igh confidence that this recent threat activity is not connected to a zero-day flaw, but instead correlates with activity related to CVE-2024-40766.”

   HuntressVendor13 Aug 2025
   Active Exploitation of SonicWall VPNs

• 173.194.194[.]94in 1 report
• a0dc80a37eb7e271…ed228d9ff526in 1 report
• 192.168.xx[.]xxxin 1 report
• 142.252.99[.]59in 1 report
• 45.86.208[.]240in 1 report
• 77.247.126[.]239in 1 report
• 104.238.205[.]105in 1 report
• 104.238.220[.]216in 1 report
• 181.215.182[.]64in 1 report

Also named with it: CVE-2023-27532, CVE-2020-3259, CVE-2023-20269, CVE-2024-40711, CVE-2025-5777, CVE-2024-4577, CVE-2024-55591