Loading story…
SonicWall has released security advisories addressing multiple vulnerabilities affecting its Email Security appliances and Gen7/Gen8 hardware and virtual firewalls. The most critical issue is a stack-based buffer overflow vulnerability in the SonicOS SSLVPN service, tracked as CVE-2025-40601, which allows remote unauthenticated attackers to cause a denial-of-service condition and crash impacted firewalls. SonicWall has stated that there is no evidence of active exploitation or public proof-of-concept code for this vulnerability, but urges immediate patching. The affected products include various models of Gen7 and Gen8 firewalls, with fixed versions now available. Gen6 firewalls and SMA SSL VPN products are not affected.
In addition to the firewall vulnerability, SonicWall also patched two vulnerabilities in its Email Security appliances, which could enable remote attackers to compromise these systems. Administrators unable to immediately apply the updates are advised to disable the SSLVPN service or restrict access to trusted sources as a temporary mitigation. The Canadian Centre for Cyber Security and SonicWall both recommend that users and administrators review the advisories and apply the necessary updates to protect their environments from potential exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
SonicWall also released patches for two Email Security flaws: CVE-2025-40604, which could enable persistent arbitrary code execution, and CVE-2025-40605, which could allow access to restricted information. These fixes were disclosed separately in connection with the same advisory coverage.
Alongside the advisory, SonicWall recommended that customers who could not immediately update disable the SonicOS SSLVPN service or restrict access to trusted sources to reduce exposure to denial-of-service attacks. These mitigations were presented as interim protections until patches could be applied.
SonicWall issued a security advisory for CVE-2025-40601, a high-severity stack-based buffer overflow in SonicOS SSLVPN that can be exploited remotely without authentication to crash affected firewalls. The company released fixed versions for affected Gen7 and Gen8 hardware and virtual firewall platforms and said it was not aware of active exploitation or a public proof-of-concept.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has disclosed a critical buffer overflow vulnerability, tracked as CVE-2025-40601, in the SSLVPN service of its SonicOS operating system. This flaw allows remote, unauthenticated attackers to trigger a firewall crash, resulting in a Denial-of-Service (DoS) condition. The vulnerability affects both hardware and virtual firewalls in the Gen7 and Gen8 product lines, including models such as TZ270–TZ670, NSa 2700–6700, NSsp 10700–15700, and their virtual equivalents on platforms like ESX, KVM, Hyper-V, AWS, and Azure. The issue is present in software versions Gen7 7.3.0-7012 and older, and Gen8 8.0.2-8011 and older, but does not impact Gen6 or SMA series devices. SonicWall has released patches to address the vulnerability and recommends immediate updates for affected systems. There is currently no evidence of active exploitation or remote code execution capabilities associated with this flaw; the primary risk is service disruption due to firewall crashes. Administrators are urged to verify whether the SSLVPN interface is enabled and to apply the necessary security updates to mitigate potential DoS attacks targeting this vulnerability.
Jun 29, 2026
SonicWall disclosed multiple vulnerabilities in **SonicOS** affecting Generation 6, 7, and 8 hardware and virtual firewall products, including flaws that could let attackers bypass access controls, reach restricted services, or trigger denial of service by crashing firewalls. The issues, identified by CrowdStrike’s Advanced Research Team and tracked as `CVE-2026-0204`, `CVE-2026-0205`, and `CVE-2026-0206`, carry CVSS scores of **8.0**, **6.8**, and **4.9** respectively, and were also reflected in advisory **dCERT 2026-1294**. SonicWall released fixed firmware versions and urged administrators to apply updates immediately. Where patching cannot be completed at once, the company advised disabling **HTTP/HTTPS management** and **SSLVPN** on all interfaces and restricting management access to **SSH**. SonicWall also warned Generation 6 customers not to downgrade from patched firmware, saying a rollback will delete LDAP users and reset MFA configurations.
Jun 29, 2026
SonicWall warned that multiple critical flaws in **Gen 6, Gen 6.5, Gen 7, and TZ80** firewalls could allow authentication bypass, arbitrary outbound connections, privileged access, and possible remote code execution on exposed devices. The disclosed issues include **`CVE-2024-40762`**, **`CVE-2024-53704`**, **`CVE-2024-53705`**, and **`CVE-2024-53706`**, with guidance to immediately install vendor updates and, if patching is delayed, disable Internet-exposed **SSLVPN** or restrict access to trusted sources. Authorities also urged organizations to review logs for suspicious local-user login attempts and other anomalous access patterns. Subsequent incident reporting tied real-world compromises of **SonicWall Gen 7** firewalls with **SSLVPN** enabled to **`CVE-2024-40766`** and password-related weaknesses introduced during **Gen 6 to Gen 7** migrations, rather than to a new zero-day as initially feared. SonicWall said many successful intrusions appeared to involve migrated local user passwords that had not been reset, creating an opening for network breaches and potential ransomware activity. Recommended mitigations include upgrading to **firmware 7.3.0**, resetting local SSLVPN user passwords, disabling unused accounts, enabling **MFA**, Botnet Protection, and Geo-IP Filtering, and limiting SSLVPN access by IP where the service remains necessary.
Jun 29, 2026