CVE-2025-40602

SonicWall SMA1000 appliance: SMA1000 Missing Authorization

As of , CVE-2025-40602 in SonicWall SMA1000 appliance is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.

Exploited
Yes: CISA listed it on 17 December 2025
US federal deadline
24 December 20257 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.03Higher than 85% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
Vendor advice: psirt.global.sonicwall.comLinks below, from CISA's entry.

What CISA says to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable

CISA's required action

  • psirt.global.sonicwall.comCheck for signs of potential compromise on all internet accessible SonicWall SMA1000 instances after applying mitigations. For more…

What the flaw is

SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.

CISA's description

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

The CVE record's description, from sonicwall

CVE published
18 December 2025
Assigned by
sonicwall
CVSS
6.6 Medium (CVSS 3.1, from CISA-ADP)
CWE-862
Missing Authorization
CWE-250
Execution with Unnecessary Privileges
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
total

Timeline

  1. CISA added it to its list of exploited vulnerabilities.
  2. The CVE record was published.
  3. The US federal deadline to fix it.

Read further