SonicWall NetExtender CVE-2026-66152

Exploitation requires the target system to run SonicWall NetExtender Linux client version 10.3.5 or earlier, and the OPSWAT tarball processing code path must be triggered - this occurs when a user initiates a VPN connection or compliance check that causes the client to fetch and extract a tarball. User interaction is required (CVSS UI:R); fully passive background exploitation without any user-initiated action is not indicated. The attacker must control or intercept the tarball delivered to the client, requiring either a network MITM position, a compromised delivery endpoint, or redirection of the client to a malicious server. This vulnerability is Linux-platform specific. Limiting factors: non-Linux NetExtender clients are not affected, the attack is not automatable per SSVC, and delivery of the malicious payload requires specific network positioning.

The vendor-provided CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high impact across all three dimensions and a network-accessible attack vector with low complexity - consistent with the severity of arbitrary root-level file write. However, several signals moderate the real-world urgency: EPSS at 0.20% (9th percentile) indicates current low exploitation probability; SSVC marks exploitation as 'none' and automatable as 'no'; and no KEV listing or public POC exists at time of analysis. The UI:R constraint means fully passive, automated exploitation is not feasible - an attacker must induce the user to trigger OPSWAT tarball extraction, which limits opportunistic mass exploitation. The AC:L assignment in the vendor vector may be optimistic, as delivering a malicious tarball plausibly requires a MITM position or control of the tarball delivery endpoint. For organizations actively running NetExtender on Linux endpoints, the root-write impact warrants prioritized patching regardless of low current exploitation signals - the total technical impact classification from SSVC underscores this. Organizations without Linux NetExtender deployments are unaffected.

An attacker positioned to intercept or substitute the OPSWAT tarball fetched by the NetExtender Linux client - via a MITM on an unprotected network or by compromising the tarball delivery endpoint - serves a crafted archive containing entries with path-traversal sequences. When the targeted user initiates a VPN connection or compliance check that triggers OPSWAT tarball extraction, the malicious paths write attacker-controlled content (such as a root crontab or SSH authorized_keys entry) to arbitrary locations as root. No public proof-of-concept code has been identified at time of analysis.