SonicWall SMA1000 Zero-Day Vulnerability CVE-2025-40602 Exploited

Arcticwolf

SonicWall SMA1000 Zero-Day Vulnerability CVE-2025-40602 Exploited

First seen 17 Dec 2025, 22:54 UTC • •61.0

Article Content

1 / 38

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

SonicWall has addressed a medium-severity zero-day vulnerability in the SMA1000 Appliance Management Console. This vulnerability is actively being exploited, affecting users of the SonicWall SMA1000. The company has released fixes to mitigate the risk associated with this security flaw.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 218d ago How this analysis works

More articles in this cluster (37)

Threat Graph

8 entities, 16 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Privilege Escalation
Zero-day Exploit

Vulnerability (2)

CVE-2025-40602
CVE-2025-6389

Affected Platform (4)

Microsoft Office
Microsoft Office Excel
Microsoft Office Word
Windows

Relationships

CVE-2025-40602 targets Microsoft Office
CVE-2025-40602 targets Microsoft Office Excel
CVE-2025-40602 targets Microsoft Office Word
CVE-2025-40602 targets Windows
CVE-2025-6389 targets Microsoft Office
CVE-2025-6389 targets Microsoft Office Excel
CVE-2025-6389 targets Microsoft Office Word
CVE-2025-6389 targets Windows
Privilege Escalation targets Microsoft Office
Privilege Escalation targets Microsoft Office Excel
Privilege Escalation targets Microsoft Office Word
Privilege Escalation targets Windows
Zero-day Exploit targets Microsoft Office
Zero-day Exploit targets Microsoft Office Excel
Zero-day Exploit targets Microsoft Office Word
Zero-day Exploit targets Windows

Following this threat?

Track CVE-2025-40602 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…