SonicWall Gen 7 firewalls targeted with SSL VPN Zero-Day vulnerability

Multiple cybersecurity incident response firms have issued urgent warnings about a significant campaign targeting SonicWall Gen 7 firewalls through what appears to be a previously unknown zero-day vulnerability in SSL VPN implementations. 

Update - as of 7th of August, SonicWall reported that the spike in attacks was not a not connected to a zero-day vulnerability. Instead, it's most probably related to CVE-2024-40766.

SonicWall recommends that users:

• Update firmware to version 7.3.0, which includes enhanced protections against brute force attacks and additional MFA controls. Firmware update guide 

• Reset all local user account passwords for any accounts with SSLVPN access, especially if they were carried over during migration from Gen 6 to Gen 7. 

The attacks, first observed on July 15, 2025, have affected fully patched SonicWall devices even after credential rotation and despite multi-factor authentication being enabled, indicating exploitation of a critical security flaw.

Arctic Wolf Labs reported the campaign on August 1, 2025, observing multiple intrusions within a short timeframe, each involving VPN access through SonicWall SSL VPNs. The cybersecurity firm noted that available evidence strongly points to the existence and exploitation of a zero-day vulnerability.

The vulnerability appears to target the SSL VPN authentication mechanism in SonicWall's Gen 7 firewall products. Evidence supporting the zero-day theory includes the fact that fully patched SonicWall devices were compromised following credential rotation, and accounts with time-based one-time password multi-factor authentication enabled were still successfully breached. This suggests the attackers are bypassing standard authentication mechanisms entirely.

The Akira ransomware group has been identified as the primary threat actor exploiting this vulnerability.

Huntress researchers have confirmed approximately 20 different attacks directly related to this campaign since July 25, 2025. The security firm observed that threat actors are moving with unprecedented speed, pivoting to domain controllers within hours of the initial breach and completing the full attack chain from initial access to ransomware deployment in as little as 1.5 to 2 hours.

The vulnerability impacts SonicWall Gen 7 firewall devices running SonicOS with SSL VPN functionality enabled. SonicWall confirmed on August 4, 2025, that it is aware of the campaign affecting Gen 7 SonicWall firewalls that use the secure sockets layer protocol. The vendor stated it is actively investigating these incidents to determine whether they are connected to a previously disclosed vulnerability or if a new vulnerability is responsible.

The reports of attacks come one week after SonicWall urged customers to patch their SMA 100 appliances for CVE-2025-40599 that may be exploited to gain remote code execution on unpatched devices. Attackers would need admin privileges for CVE-2025-40599 exploitation, but SonicWall still urged administrators to secure their SMA 100 appliances, as they're already being targeted.

As of 10th of September 2025 the Australian Cyber Security Center warns of increased exploitation activity and that Akira ransomware gang is actively exploiting CVE-2024-40766.

Given the high likelihood of a zero-day vulnerability, organizations should immediately consider disabling SonicWall SSL VPN services until a patch becomes available and can be deployed.

As an alternative, organizations should limit SSL VPN connectivity to trusted source IP addresses only.