SonicWall NetExtender Vulnerabilities Enable Root Privilege Escalation via Arbitrary File Writes
SonicWall has disclosed two vulnerabilities in its NetExtender Linux client, including a critical path traversal flaw allowing arbitrary file writes as root.
SonicWall has alerted users to two security vulnerabilities affecting its NetExtender Linux client, with versions 10.3.5 and earlier being susceptible. The most severe of these, tracked as CVE-2026-66152, is a critical path traversal flaw that could allow a remote attacker to gain root privileges by writing arbitrary files to the system. This vulnerability, with a CVSS score of 8.8, stems from the way the Linux client handles OPSWAT tarballs. By exploiting path traversal sequences, an attacker can place files outside their intended extraction directory. Since the operation runs with root privileges, this can lead to significant privilege escalation, enabling the overwriting of critical configuration files, the placement of malicious scripts, or the alteration of startup processes.
The vulnerability is categorized under CWE-29, Path Traversal, which involves using sequences like .. to navigate outside a designated directory. In archive extraction scenarios, improper handling of file paths can allow specially crafted archive entries to write data to unintended locations on the system. The potential impact is highly dependent on the target environment, file permissions, and whether a user can be tricked into interacting with a malicious update or archive.
A second vulnerability, CVE-2026-66153, involves an improper link resolution flaw within the NetExtender Linux client's auto-upgrade process. This issue, rated with a CVSS score of 7.0 and classified as CWE-59 (Improper Link Resolution Before File Access), could allow a local attacker with low privileges to manipulate file paths using symbolic links. This could influence where files are accessed or written, potentially leading to unauthorized actions or data corruption.
While CVE-2026-66152 has a network attack vector and requires user interaction, CVE-2026-66153 is a local attack with high complexity. Both vulnerabilities can impact the confidentiality, integrity, and availability of affected systems if successfully exploited. SonicWall has stated that there is currently no evidence of these vulnerabilities being exploited in the wild.
To mitigate these risks, administrators are strongly advised to upgrade affected NetExtender Linux Client installations to version 10.3.6 or later. SonicWall's advisory SNWLID-2026-0013, published on August 25, 2026, provides further details. No workarounds are available for these issues.
Organizations deploying the SonicWall NetExtender Linux client should prioritize this update, given its widespread use for remote access to corporate networks. Security teams should also conduct an inventory of unmanaged Linux endpoints, verify the installed client versions, and review their privileged software update mechanisms for any unsafe archive extraction or temporary file handling practices.
It is important to note that SonicWall has confirmed that Windows-based NetExtender client versions are not affected by these specific vulnerabilities. The disclosure highlights the ongoing need for vigilance in securing remote access solutions and promptly applying vendor-provided patches.