--- title: Critical Vulnerabilities in SonicWall SMA 100 Series Appliances description: Recent developments have highlighted critical vulnerabilities in SonicWall's Secure Mobile Access (SMA) 100 series appliances, with active exploitation reported. --- [Skip to content](https://1898advisories.burnsmcd.com/critical-vulnerabilities-in-sonicwall-sma-100-series-appliances#main-content) ![1898-logo-grey-R-1](https://1898advisories.burnsmcd.com/hs-fs/hubfs/1898-logo-grey-R-1.webp?width=188&height=100&name=1898-logo-grey-R-1.webp) - [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) - [Threat Hunt](https://1898advisories.burnsmcd.com/tag/threat-hunt) - [View All](https://1898advisories.burnsmcd.com/) Open main navigation Close main navigation - [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) - [Threat Hunt](https://1898advisories.burnsmcd.com/tag/threat-hunt) - [View All](https://1898advisories.burnsmcd.com/) - [Contact us](https://1898andco.burnsmcd.com/contact-us) [Contact us](https://1898andco.burnsmcd.com/contact-us) January 9, 2026 # Critical Vulnerabilities in SonicWall SMA 100 Series Appliances ![Picture of The 1898 & Co. Team](https://1898advisories.burnsmcd.com/hs-fs/hubfs/1898%20Cyberthreat%20Advisory%20Blog%20Assets/1898-Co-Ampersand.png?width=50&name=1898-Co-Ampersand.png) [The 1898 & Co. Team](https://1898advisories.burnsmcd.com/author/1898-co-team) Recent developments have highlighted critical vulnerabilities in SonicWall's Secure Mobile Access (SMA) 100 series appliances, with active exploitation reported. The primary vulnerability, CVE-2025-40602, involves local privilege escalation due to insufficient authorization in the appliance management console. This flaw, with a CVSS score of 6.6, has been actively exploited in the wild. SonicWall has released patches to address this issue, urging users to update their systems promptly. The vulnerability CVE-2025-40602 is particularly concerning as it can be combined with another severe vulnerability, CVE-2025-23006, which allows unauthenticated remote code execution with root privileges. This combination poses a significant threat to affected systems. CVE-2025-23006 was previously patched in January 2025, but the recent exploitation of CVE-2025-40602 underscores the need for immediate action. Google's Threat Intelligence Group has been tracking a campaign targeting end-of-life SonicWall SMA 100 series devices, potentially linked to a backdoor named OVERSTEP. While the connection between these activities and the current vulnerabilities remains unclear, the active exploitation of these flaws necessitates urgent attention from all users of the affected systems. #### Threats and Vulnerabilities CVE-2025-40602 is a local privilege escalation vulnerability affecting SonicWall SMA 100 series appliances. It arises from insufficient authorization checks in the appliance management console, allowing attackers to gain elevated privileges. This vulnerability has been actively exploited, highlighting its potential impact on system security. CVE-2025-23006 is a critical vulnerability that enables unauthenticated remote code execution with root privileges. When combined with CVE-2025-40602, it poses a severe risk to affected systems, allowing attackers to execute arbitrary code remotely. This vulnerability was patched earlier in 2025, but its combination with CVE-2025-40602 increases the threat level. The campaign tracked by Google's Threat Intelligence Group involves targeting fully-patched end-of-life SonicWall SMA 100 series devices. The attackers aim to deploy a backdoor called OVERSTEP, although the relationship between this campaign and the current vulnerabilities is not yet confirmed. The ongoing exploitation of these vulnerabilities highlights the need for vigilance and prompt patching. #### Client Impact Clients using SonicWall SMA 100 series appliances are at risk of operational disruptions due to potential unauthorized access and control over their systems. The exploitation of these vulnerabilities could lead to data breaches, resulting in data loss and financial consequences. Additionally, organizations may face reputational damage if sensitive information is compromised. From a compliance perspective, failure to address these vulnerabilities could result in regulatory challenges and audits. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that Federal Civilian Executive Branch agencies apply the necessary fixes by December 24, 2025. Non-compliance could lead to penalties and increased scrutiny from regulatory bodies. #### Mitigations To mitigate the risks associated with these vulnerabilities, clients should take the following actions: 1. Apply the latest patches provided by SonicWall for SMA 100 series appliances immediately to address CVE-2025-40602 and CVE-2025-23006. 2. Conduct a thorough review of network configurations and access controls to ensure only authorized users have access to critical systems. 3. Implement robust monitoring and logging practices to detect any unusual activity or unauthorized access attempts. 4. Educate employees about phishing attacks and social engineering tactics that could be used to exploit these vulnerabilities. 5. Consider deploying additional security measures such as intrusion detection systems (IDS) and endpoint protection solutions. By taking these steps, clients can significantly reduce their exposure to these vulnerabilities and enhance their overall security posture. It is crucial to remain vigilant and proactive in applying security updates and monitoring for potential threats. #### 1898 & Co. Response 1898 & Co. is actively addressing the current threat landscape by offering specialized services to help clients secure their SonicWall SMA 100 series appliances. Our team is focused on providing tailored solutions that address these specific vulnerabilities and enhance overall network security. We are updating our security protocols and practices to incorporate the latest threat intelligence and mitigation strategies. Our collaborative efforts with industry allies and government agencies ensure that we stay ahead of emerging threats and provide our clients with the most effective security measures. Our ongoing research and threat intelligence gathering activities enable us to offer clients timely insights into potential risks and vulnerabilities. We have successfully assisted numerous organizations in mitigating similar threats, demonstrating our capability to deliver effective security solutions. #### Sources Critical Vulnerabilities in SonicWall SMA 100 Series Appliances [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) *The information in this cybersecurity advisory is provided "as is" for informational purposes only. 1898 & Co. does not provide any warranties or guarantees of any kind regarding this information. You assume all risks if you choose to rely on this information. In no event shall 1898 & Co. or its contractors or subcontractors be liable for any damages including, but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with, this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information* *1898 & Co. does not endorse any product or service, except as expressly stated otherwise. Any reference to products or processes does not constitute or imply 1898 & Co.’s endorsement or recommendation.* Subscribe ✕ Close   [Accessibility](https://1898andco.burnsmcd.com/accessibility)  |  [Privacy Statement](https://1898andco.burnsmcd.com/privacy) © 2026 1898 & Co., a part of Burns & McDonnell. All Rights Reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "The 1898 & Co. Team", "url" : "https://1898advisories.burnsmcd.com/author/1898-co-team" }, "dateModified" : "2026-04-29T18:13:03.789Z", "datePublished" : "2026-01-09T20:20:59.000Z", "headline" : "Critical Vulnerabilities in SonicWall SMA 100 Series Appliances", "mainEntityOfPage" : { "@id" : "https://1898advisories.burnsmcd.com/critical-vulnerabilities-in-sonicwall-sma-100-series-appliances", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "//cdn2.hubspot.net/hub/477837/file-2585615236-jpg/Logo_1_Primary_2Color1.jpg" }, "name" : "Burns & McDonnell Engineering Co" } } ```