SonicWall NetExtender Flaw: When Your VPN Client Is the Weak Link

Part of watching out for our customers is reading the security advisories that most small businesses will never see. This week one crossed our desk that's worth passing on — not because anyone has been attacked, but because it makes a point we think every SMB with remote workers should hear: the VPN client sitting on your laptops is part of your network, and it needs looking after just like the firewall does.

What happened, in plain English

On 25 August 2026, SonicWall published security advisory SNWLID-2026-0013 covering two vulnerabilities in NetExtender, its SSL VPN client — the software staff install on their computers to dial back into the office through a SonicWall firewall or SMA appliance. Both flaws affect only the Linux version of the client, versions 10.3.5 and earlier.

The more serious one, CVE-2026-66152, is a path traversal bug in how the client unpacks an archive for its bundled OPSWAT component — the piece that checks a connecting machine meets security requirements. Because that operation runs with root privileges, a specially crafted archive can plant files anywhere on the system, and on Linux, writing arbitrary files as root is effectively a full takeover of the machine. It scores a CVSS 8.8 (High).

Here's the honest nuance, though, because the score alone doesn't tell you how an attack actually happens. The CVSS vector says no authentication is needed — but it also says user interaction is required. In practice, someone has to be induced to connect their NetExtender client to a malicious or tampered-with endpoint. This is not something an anonymous attacker can simply fire at idle laptops across the internet.

The second flaw, CVE-2026-66153 (CVSS 7.0), is a link-following bug in how the client's NEService auto-upgrade process handles temporary files. It requires an attacker who already has a low-privileged account on the same machine, and it's rated high-complexity — so it mainly matters on shared, multi-user Linux systems, where it could let a limited user escalate their access.

Three more facts that frame the risk properly:

• A fix exists: NetExtender Linux client 10.3.6 or later. There is no workaround — updating is the fix.
• The Windows client is not affected by these two flaws.
• Neither flaw is known to be exploited. SonicWall reports no evidence of exploitation in the wild, neither CVE appears on CISA's Known Exploited Vulnerabilities list, and CISA's own assessment (26 August) records exploitation as "none". This is the good kind of advisory: the patch arrived before the bad news.

Why it matters: the forgotten half of the VPN

Most businesses that think about VPN security think about the box at the office end — the firewall or VPN appliance. That box usually gets attention: it's on an asset list, someone updates its firmware, it might even be under a support contract.

The client software on the other end of the tunnel is the forgotten half. It gets installed once, when a laptop is set up or an employee starts working from home, and then it quietly does its job for years. Nobody inventories it. Nobody patches it. And yet, by design, VPN clients run with root or administrator privileges — they have to, to manage network interfaces — which makes them one of the most privileged pieces of software on the machine.

There's a small irony worth sitting with here, too: the vulnerable component in CVE-2026-66152 is part of the endpoint-compliance machinery — the code whose job is to check that your computer is safe enough to connect. Security software is still software. It has bugs like everything else, and because of the privileges it holds, its bugs tend to matter more.

The honest bit

We say this in every post in this series, and we'll keep saying it: no vendor is immune, including the ones we like. We've written the same kind of piece about Cisco's RV routers and about Fortinet credential exposure. This time it's SonicWall's turn, and to their credit, this is what responsible handling looks like: the flaws were reported externally, fixed, and disclosed with CVE numbers before anyone was known to be attacked.

One genuine structural observation, offered as advice rather than a pitch: cloud-managed network gear can have fixes pushed to the hardware automatically — but no management platform can patch the client software sitting on a staff laptop unless you've set up some form of endpoint management. Client software always needs a human owner. That's the real lesson of this advisory.

What we'd suggest you actually do

1. Find out if anyone in your business uses NetExtender on Linux. It's a smaller population than Windows — typically developers, IT staff, or that one engineer with a Linux laptop — which is exactly why it gets missed.
2. Update any affected installs to version 10.3.6 or later. There's no workaround for these flaws, so the update is the whole job.
3. While you're at it, check the client versions on Windows and macOS machines too. They're not affected by these particular CVEs, but old VPN clients accumulate other problems, and you're already looking.
4. Add remote-access clients to your patch list. If your update routine covers the firewall but not the VPN software on laptops, this advisory is your prompt to fix that — it applies whatever brand you run.
5. Remind staff to connect only to your organisation's own VPN address. The serious flaw here needs a user to connect to a malicious endpoint; a workforce that knows not to accept unexpected VPN profiles or links is a real mitigation.
6. Patch shared Linux machines promptly. The second flaw is a local privilege-escalation path, so multi-user systems are where it bites.

None of that requires buying anything — it's inventory, updating, and a conversation with your team.

The friendly takeaway

This one is about as low-drama as security advisories get: a limited set of affected machines, no known attacks, and a fix already available. The reason we're writing it up anyway is the pattern underneath — the software you install to be safe runs with the highest privileges on the machine, and it's often the software nobody is watching.

We read these advisories every week so our customers don't have to. If you're not sure which VPN clients are floating around your business, what versions they're on, or who's meant to be updating them, and you'd like a second pair of eyes over your remote-access setup — get in touch. No obligation, no hard sell; sometimes the answer is simply "you're fine, carry on."

This post is part of our ongoing security-watch series for Australian small businesses. Recent entries: the Cisco RV router end-of-life reminder, FortiBleed and patch hygiene, and the danger of forgotten gear.

References

• SonicWall PSIRT advisory SNWLID-2026-0013: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013
• NVD, CVE-2026-66152: https://nvd.nist.gov/vuln/detail/CVE-2026-66152
• NVD, CVE-2026-66153: https://nvd.nist.gov/vuln/detail/CVE-2026-66153
• CISA Known Exploited Vulnerabilities catalogue (neither CVE listed as at 29 August 2026): https://www.cisa.gov/known-exploited-vulnerabilities-catalog