SonicWall SMA1000 Appliance Zero-Day Vulnerability Exploited by Hackers for RCE

• SonicWall announced a zero-day vulnerability in its SMA1000 AMC and CMC is actively exploited in the wild.
• The critical flaw exposes affected systems to significant risk, as malicious actors can bypass security protocols entirely.
• In specific conditions, the zero-day pre-authentication deserialization of untrusted data can be exploited for remote code execution.

Hackers are actively exploiting a recently discovered zero-day vulnerability in SonicWall's SMA1000 remote access appliance, breaching corporate networks that utilize the enterprise-grade product. 

Tracked as CVE-2025-23006, it affects the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC). SonicWall confirmed the attack in a security advisory, urging customers to patch their affected systems immediately.

The pre-authentication deserialization of untrusted data vulnerability allows attackers to deploy malware on compromised devices remotely without requiring authentication credentials. 

In specific conditions, a remote, unauthenticated attacker could execute arbitrary OS commands.

This exploit was initially identified by Microsoft and disclosed to SonicWall last week. Within days, SonicWall confirmed that the bug had already been “actively exploited in the wild,” highlighting that some of its corporate customers had already suffered attacks. However, neither SonicWall nor Microsoft disclosed the number of compromised networks.

To mitigate risks, SonicWall has since released a security hotfix and is urging customers to install the patch on vulnerable devices without delay.

The number of cyberattacks targeting enterprise-grade cybersecurity products is growing. Tools such as remote access appliances, VPNs, and firewalls can also harbor vulnerabilities that, once exploited, compromise the very networks they are meant to protect.

Major cybersecurity vendors—including Cisco, Fortinet, Ivanti, and more—have disclosed zero-day vulnerabilities in recent years that hackers have leveraged to breach corporate networks.