CVE-2025-40604 is a critical flaw (CVSS 9.8) in SonicWall Email Security appliances. The root filesystem image is loaded without a signature check, so someone with access to the VMDK or datastore could plant code that persists. Read advisory SNWLID-2025-0018 for fixed releases.
What's affected
The record lists the SonicWall Email Security appliance models 5000, 5050, 7000 and 7050 and their firmware. The record text describes the issue as a download of code without an integrity check in the Email Security appliance.
I could not read the SonicWall advisory page, because it loads its content with scripts. The record gives no version range and no fixed release, so I cannot state them. Open advisory SNWLID-2025-0018 on the SonicWall PSIRT site and use it for the exact affected and fixed versions.
The record says an attacker with VMDK or datastore access can modify system files. The VMDK is the virtual disk file used by virtual machines, which suggests the exposure sits with virtual deployments, but check this against the advisory instead of assuming it.
How to check if you're exposed
- List your SonicWall Email Security appliances, physical and virtual, and note the model and firmware version in the admin console.
- Open SNWLID-2025-0018 and compare your version with the affected and fixed lists.
- For virtual appliances, list who can reach the datastore and the virtual disk files, and who can copy, mount or edit them. That includes hypervisor admins, backup systems and storage admins.
- Check that the virtual disk files are not stored on shared locations that more people can write to than should.
This is a review of access, not a command to run. The risk depends on who can touch the disk.
What to do now
- Apply the fix named in SonicWall advisory SNWLID-2025-0018 to every affected appliance. Follow the vendor's upgrade order and take a backup first.
- Restrict write access to the datastores and virtual disks that hold the appliance to the few people who need it, and turn on logging for changes there.
- Review hypervisor and storage accounts, and remove stale ones.
- If you cannot confirm who has had access, treat the appliance as one to rebuild from a known good image after you update, then rotate its credentials and keys.
- Record the appliance versions in your inventory so you can show which are done.
Why it matters
The record maps the issue to CWE-494, download of code without integrity check. A system that loads its root filesystem image without verifying a signature will run whatever the image contains. The record says this allows attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
The persistence is what makes it serious. Code planted in the system image survives reboots, and it sits on a device that handles all inbound mail, so it can see sensitive messages. The score of 9.8 reflects that, though in practice the attacker needs the access described in the record, which narrows who can use it.
This CVE is not on the CISA Known Exploited Vulnerabilities list. Appliances are easy to forget in patch work because they are not on the usual package manager. The Gold directory lists the CVE for tracking, and our free in-browser dependency scan can check your own applications, but the appliance itself needs the vendor update.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this exposed to the internet?
The record describes attackers with VMDK or datastore access, so the question is who can reach your virtual disks. Confirm the details in SonicWall advisory SNWLID-2025-0018.
Sources
The SonicWall page did not render its text for me, so the details above come from the CVE record. Read the advisory for versions.
Last reviewed: 18 October 2026.
