Arcticwolf

SonicWall SMA1000 Zero-Day Vulnerability CVE-2025-40602 Exploited

First seen 17 Dec 2025, 22:54 UTC • Api.Msrc.Microsoft

•61.0

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

SonicWall has addressed a medium-severity zero-day vulnerability in the SMA1000 Appliance Management Console. This vulnerability is actively being exploited, affecting users of the SonicWall SMA1000. The company has released fixes to mitigate the risk associated with this security flaw.

How this analysis works

Attack Flow

24 entities, 60 inferred relationships (STIX 2.1).

Technique (7)

Data Breach
Privilege Escalation
Spoofing
Zero-day Exploit
Cross-site Scripting
T1059.001 - PowerShell
T1068 - Exploitation for Privilege Escalation

Vulnerability (5)

CVE-2025-40602
CVE-2025-6389
XSS
Type Confusion
Use After Free

Affected Platform (11)

Copilot
Microsoft Brokering File System
Microsoft Exchange Server
Microsoft Office
Microsoft Office Access
Microsoft Office Excel
Microsoft Office Outlook
Microsoft Office SharePoint
Microsoft Office Word
SonicWall Sma1000 Appliance Management Console
Windows

Tool (1)

PowerShell

Relationships

PowerShell exploits CVE-2025-40602
PowerShell exploits CVE-2025-6389
PowerShell exploits XSS
PowerShell exploits Type Confusion
PowerShell exploits Use After Free
CVE-2025-40602 targets Copilot
CVE-2025-40602 targets Microsoft Brokering File System
CVE-2025-40602 targets Microsoft Exchange Server
CVE-2025-40602 targets Microsoft Office
CVE-2025-6389 targets Copilot
CVE-2025-6389 targets Microsoft Brokering File System
CVE-2025-6389 targets Microsoft Exchange Server
CVE-2025-6389 targets Microsoft Office
XSS targets Copilot
XSS targets Microsoft Brokering File System
XSS targets Microsoft Exchange Server
XSS targets Microsoft Office
Type Confusion targets Copilot
Type Confusion targets Microsoft Brokering File System
Type Confusion targets Microsoft Exchange Server
Type Confusion targets Microsoft Office
Use After Free targets Copilot
Use After Free targets Microsoft Brokering File System
Use After Free targets Microsoft Exchange Server
Use After Free targets Microsoft Office
Data Breach targets Copilot
Data Breach targets Microsoft Brokering File System
Data Breach targets Microsoft Exchange Server
Data Breach targets Microsoft Office
Privilege Escalation targets Copilot
Privilege Escalation targets Microsoft Brokering File System
Privilege Escalation targets Microsoft Exchange Server
Privilege Escalation targets Microsoft Office
Spoofing targets Copilot
Spoofing targets Microsoft Brokering File System
Spoofing targets Microsoft Exchange Server
Spoofing targets Microsoft Office
Zero-day Exploit targets Copilot
Zero-day Exploit targets Microsoft Brokering File System
Zero-day Exploit targets Microsoft Exchange Server
Zero-day Exploit targets Microsoft Office
Cross-site Scripting targets Copilot
Cross-site Scripting targets Microsoft Brokering File System
Cross-site Scripting targets Microsoft Exchange Server
Cross-site Scripting targets Microsoft Office
T1059.001 - PowerShell targets Copilot
T1059.001 - PowerShell targets Microsoft Brokering File System
T1059.001 - PowerShell targets Microsoft Exchange Server
T1059.001 - PowerShell targets Microsoft Office
T1068 - Exploitation for Privilege Escalation targets Copilot
T1068 - Exploitation for Privilege Escalation targets Microsoft Brokering File System
T1068 - Exploitation for Privilege Escalation targets Microsoft Exchange Server
T1068 - Exploitation for Privilege Escalation targets Microsoft Office
CVE-2025-40602 related to Microsoft Office Access
CVE-2025-40602 related to Microsoft Office Excel
CVE-2025-40602 related to Microsoft Office Outlook
CVE-2025-40602 related to Microsoft Office SharePoint
CVE-2025-40602 related to Microsoft Office Word
CVE-2025-40602 related to SonicWall Sma1000 Appliance Management Console
CVE-2025-40602 related to Windows

Continue Reading

Multiple Critical Vulnerabilities Exploited in SonicWall and SharePoint Systems Microsoft March 2026 Patch Tuesday Addresses 79 Vulnerabilities, Including Zero-Days Microsoft June 2026 Patch Tuesday: Record 206 Vulnerabilities Addressed Adobe and Microsoft June 2026 Security Updates Address Critical Vulnerabilities Malicious Browser Add-Ons Exploit AI Platform Users Critical RCE Vulnerability in BeyondTrust Software Requires Immediate Patching

SonicWall SMA1000 Zero-Day Vulnerability CVE-2025-40602 Exploited

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading