SonicWall warns of SMA1000 RCE flaw exploited in zero-day attacks

SonicWall disclosed a critical pre-authentication deserialization vulnerability (CVE-2025-23006, CVSS 9.8) in SMA1000 Appliance Management Console and Central Management Console that has been reported exploited as a zero-day; administrators are urged to apply the platform-hotfix (12.4.3-02854 and later) immediately, as thousands of devices are exposed online and active exploitation has been observed.