QwikSec

Security Database

CVE

CWE

Training

CVE-2025-40604

Published: Nov 20, 2025

Modified: Feb 26, 2026

PUBLISHED

Description

Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.

Vendor	Product	Versions
SonicWall	Email Security	affected `10.0.33.8195 and earlier versions`

Weaknesses (CWE)

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.