Loading story…
SonicWall has released urgent patches for a local privilege escalation vulnerability (CVE-2025-40602) in its Secure Mobile Access (SMA) 1000 appliances, following reports of active exploitation in the wild. Attackers have been chaining this flaw with a previously patched deserialization vulnerability (CVE-2025-23006) to achieve unauthenticated remote code execution with root privileges on affected devices. The vulnerabilities impact the Appliance Management Console (AMC) and Central Management Console (CMC), and SonicWall has advised customers to upgrade to the latest hotfix versions and restrict management interface access to mitigate risk.
Security advisories from multiple sources, including government agencies and SonicWall itself, emphasize the criticality of patching due to the widespread use of SMA1000 appliances in large enterprises and critical infrastructure. Over 950 internet-exposed SMA1000 devices have been identified, heightening concerns about potential exploitation. No indicators of compromise have been released, but organizations are urged to apply the fixes immediately and review their exposure to the AMC and SSH interfaces to prevent further attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On December 17, 2025, the Canadian Centre for Cyber Security issued alert AV25-845 highlighting SonicWall's advisory and affected SMA versions. It urged administrators to review SonicWall guidance and apply the recommended updates.
In its December 17, 2025 disclosure, SonicWall said attackers were chaining CVE-2025-40602 with the previously patched CVE-2025-23006. The combination enables unauthenticated remote code execution with root privileges on vulnerable SMA 1000 appliances.
On December 17, 2025, SonicWall disclosed CVE-2025-40602, an actively exploited local privilege escalation flaw in the SMA 1000 Appliance Management Console caused by insufficient authorization. The company released hotfixes, credited Google Threat Intelligence Group researchers Clément Lecigne and Zander Work with reporting the issue, and urged customers to restrict management access and patch immediately.
At an unspecified point after exploitation of CVE-2025-23006 became known, the U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog. This reflected official recognition that the vulnerability was being actively exploited.
Earlier in January 2025, SonicWall remediated CVE-2025-23006, a critical deserialization vulnerability in SMA 1000 appliances. Later reporting said this flaw could be chained with CVE-2025-40602 to achieve unauthenticated remote code execution with root privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
secpod.com
Open sourcethecyberthrone.in
Open sourcego.theregister.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcepsirt.global.sonicwall.com
Open sourcetenable.com
Open sourcearcticwolf.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Jul 24, 2026
SonicWall disclosed four vulnerabilities in **Secure Mobile Access (SMA) 1000** series appliances that could allow **SQL injection-based privilege escalation**, **unauthenticated user credential enumeration**, and **multi-factor authentication bypass**. The issues affect SMA 1000 deployments through flaws in SQL handling and Unicode processing, with the most severe bug tracked as **`CVE-2026-4112`** and rated **CVSS 7.2**. SonicWall said the vulnerabilities do **not** impact SSL-VPN functionality on standard SonicWall firewalls. According to SonicWall's advisory **`SNWLID-2026-0003`**, the Unicode-related flaws can bypass **TOTP** protections in **AMC**, **Workplace**, or **Connect Tunnel** authentication flows, increasing the risk of unauthorized access. SonicWall said it has **no evidence of active exploitation** and provided **hotfixes and fixed releases** for affected SMA 1000 versions, adding that **no workarounds or alternative mitigations are available**, making patching the required response for exposed systems.
Jun 29, 2026
Mandiant reported that attackers exploited zero-day vulnerabilities in **SonicWall Email Security** appliances to gain access to enterprise environments. The activity involved compromise of internet-facing email security infrastructure, giving intruders an initial foothold through a trusted security product positioned in front of corporate mail systems. The incident highlights the risk posed by flaws in perimeter security appliances, where successful exploitation can bypass normal defenses and expose downstream enterprise systems. Mandiant said the zero-day exploitation resulted in real-world intrusions, underscoring the need for organizations using SonicWall Email Security to urgently review vendor guidance, investigate appliance activity, and assess whether related enterprise compromise occurred.
Jul 12, 2026