SonicWall NetExtender CVE-2026-66153

Exploitation requires: (1) a local, low-privileged account on the target Linux system - remote unauthenticated access is not sufficient; (2) the NEService auto-upgrade process must be active or triggerable, meaning the NetExtender Linux client must be installed and its upgrade service running; (3) the attacker must win a race condition between temp file creation and use by NEService, making timing and repeated attempts necessary. Limiting factors include: local access requirement eliminates internet-facing attack surface; AC:H race condition makes reliable exploitation difficult and non-automatable (confirmed by SSVC); no user interaction from a victim is required once the attacker has local access. NetExtender versions after 10.3.5 and Windows client variants are not confirmed affected by available data.

Real-world risk is meaningful but operationally constrained. The CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the attack profile: exploitation requires physical or interactive local access, a low-privileged account, and precise timing to win the race condition (AC:H), making opportunistic mass exploitation infeasible. SSVC corroborates this - Automatable: no, Exploitation: none - ruling out autonomous attack chains. However, the Technical Impact is classified as 'total,' meaning a successful exploit can fully compromise the affected host. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. No KEV listing and no POC code have been identified. The primary real-world risk scenario is a targeted insider threat or post-initial-access lateral movement by an attacker already holding a low-privileged shell on a Linux system running NetExtender. Tags include 'Information Disclosure,' though the CVSS impact metrics indicate the vulnerability extends well beyond disclosure to full host compromise.

An attacker who has already obtained a low-privileged shell on a Linux endpoint running NetExtender 10.3.5 or earlier monitors for NEService auto-upgrade activity and, during the window between temporary file creation and use, replaces the temp file path with a symlink pointing to /etc/sudoers or another privileged file. When NEService writes upgrade data to what it believes is a temp file, it instead overwrites the symlink target, granting the attacker privilege escalation to root. No public proof-of-concept code has been identified, and the high attack complexity (race condition timing) means exploitation requires multiple attempts or precise process synchronization.