CVE-2025-40600: SonicWall SonicOS

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.

Affected products

• SonicWall SonicOS: from 7.1.1-7040, before 7.3.0-7012 (fixed in 7.3.0-7012)

Published 2025-07-29. Last modified 2026-06-17.