Sonicwall warns of new SMA1000 zero-day exploited in attacks

SonicWall warned of an actively exploited zero-day chain against SMA1000 appliances that chains a medium-severity local privilege escalation (CVE-2025-40602) with a critical pre-auth deserialization RCE (CVE-2025-23006, CVSS 9.8) to achieve root-level remote code execution; vendors have released hotfixes and over 950 exposed devices remain visible online, raising significant risk to organizations using these remote-access gateways.