CVE-2026-66153: CWE-59 Improper link resolution before file access ('link following') in SonicWall NetExtender

The vulnerability identified as CVE-2026-66153 affects the SonicWall NetExtender Linux client. Specifically, the NEService auto-upgrade process insecurely handles temporary files, which allows an attacker to manipulate file paths through improper link resolution (CWE-59). This flaw can lead to unauthorized disclosure, modification, or deletion of files. The CVSS v3.1 base score is 7.0 (High), with attack vector local, attack complexity high, privileges required low, no user interaction, and impacts on confidentiality, integrity, and availability all rated high. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker with local access to manipulate file paths during the auto-upgrade process, potentially leading to unauthorized disclosure, modification, or deletion of files. This impacts confidentiality, integrity, and availability of the affected system. However, exploitation requires local access and has high attack complexity, limiting the ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to the NEService auto-upgrade process. Avoid running the auto-upgrade process in untrusted environments.