SonicWall has revealed two significant security flaws in its NetExtender Linux client, one of which is a critical path traversal vulnerability. This flaw allows attackers to create arbitrary files with root-level access.
The vulnerabilities impact NetExtender Linux Client versions 10.3.5 and earlier, with the secure version being 10.3.6 and beyond. The most critical of these, tracked as CVE-2026-66152, has a CVSS score of 8.8.
Path Traversal Vulnerability Details
SonicWall identified that the flaw originates from how the client processes an OPSWAT tarball. Attackers can exploit this path traversal vulnerability to place files outside the intended directory.
Due to the process running with root privileges, successful exploitation might result in arbitrary file creation as root. This could severely compromise a Linux system, depending on the files an attacker targets and their subsequent use by the OS or applications.
Potential Impact and Exploitation
An attacker might aim to modify configuration files, insert harmful scripts in directories accessed by privileged processes, or change startup files. The overall impact varies with the system environment, file permissions, and user interaction with malicious updates or archives.
The vulnerability is categorized as CWE-29, Path Traversal, associated with attacks using special sequences to escape targeted directories. Inadequate path handling during archive extraction can lead to files being written in unintended system locations.
Additional Vulnerability: Improper Link Resolution
SonicWall also addressed CVE-2026-66153, an improper link resolution flaw affecting the NetExtender Linux client’s NEService auto-upgrade process. A local attacker could use symbolic links to manipulate file paths, influencing file access or write locations.
This flaw, with a CVSS score of 7.0, is classified as CWE-59, highlighting symlink-following risks. When privileged software handles files in attacker-controlled locations, it poses significant risks to confidentiality, integrity, and availability.
While there’s no evidence of these vulnerabilities being exploited in real-world scenarios, SonicWall stresses the importance of swift patching. Since NetExtender is widely used for remote access to corporate systems, upgrading to version 10.3.6 or later is critical.
SonicWall’s advisory SNWLID-2026-0013, released on August 25, 2026, provides further documentation. Administrators are advised to update affected installations promptly, and security teams should monitor Linux endpoints and update mechanisms for vulnerabilities.
