SonicWall has disclosed two serious vulnerabilities in its NetExtender Linux client, including a path traversal flaw that could let attackers write arbitrary files with root privileges. These issues affect NetExtender versions 10.3.5 and earlier. The fixes are available starting with version 10.3.6. The most severe flaw, tracked as CVE-2026-66152, carries a critical severity rating with a CVSS score of 8.8.
The Fixes That Matter
The CVE-2026-66152 issue arises from unsafe path handling when the Linux client processes an OPSWAT tarball. Because the extraction routine runs with root access, specially crafted path traversal sequences allow files to be placed outside intended directories. If exploited, this can lead to overwriting configuration files, dropping malicious scripts into privileged locations, or altering startup files — depending on where attackers gain write permissions and how those files interact with system processes.
The second vulnerability, CVE-2026-66153, involves insecure symbolic link resolution during the client’s auto-upgrade process. A local user with limited privileges could establish symbolic links that redirect temporary file handling to unexpected paths, allowing modifications in places the user should not reach. This bug has been given a CVSS score of 7.0 and is classified under CWE-59 (Improper Link Resolution).
Risks & Mitigations
While CVE-2026-66152 can be triggered remotely and requires user interaction, CVE-2026-66153 is a local issue with lower privileges but still significant potential if fortified processes misuse temporary paths. Both vulnerabilities threaten the confidentiality, integrity, and availability of affected systems if exploited successfully.
At the time of disclosure, there’s no evidence these flaws have been exploited in real-world attacks. Nonetheless, usage of NetExtender in many enterprise remote-access environments makes rapid patching essential. Currently, no workaround is offered.
To remediate: administrators should upgrade all Linux NetExtender clients from versions 10.3.5 or older to version 10.3.6 or newer. It’s also important for security teams to audit unmanaged Linux machines, check which versions are installed, and ensure that archive extraction and temporary file handling in privileged software avoid unsafe behaviors. The Windows NetExtender client is not affected by these vulnerabilities.
The issues were officially published in advisory SNWLID-2026-0013 on August 25, 2026.
From a technical standpoint, this reveals once again how dangerous weak handling of archives or symbolic links can be when critical operations are performed as root. These vulnerabilities underscore the need for strict path validation, safe temporary directories, and the principle of least privilege.
In an environment where remote access tools are fundamental to business operations, these Linux client flaws deserve serious attention. Monitoring updates and stepping up controls on file-handling routines can spell the difference between secure remote access and a breach waiting to happen.
Analysis: Why This Matters & What to Watch
This isn’t the first time path traversal or link resolution bugs have let attackers break into systems via trusted software. What makes these vulnerabilities especially risky is their presence in remote access tools used by organizations for VPN-style connectivity. If attackers can write files as root, they may set up persistent footholds or manipulate critical startup scripts. Going forward, organizations should watch for any unexpected behavior after upgrading, make sure only minimal privileges are used for operations not needing root, and avoid automating archive extraction without strong sanitization. Staying up to date on client versions and auditing file system permissions are no longer optional—they’re essential.
