CVE-2025-40602 is a local privilege escalation vulnerability in SonicWall SMA 1000 appliance management console that has been exploited in the wild in a chained attack with CVE-2025-23006, a deserialization vulnerability. The combination allows unauthenticated attackers to execute arbitrary code with root privileges on affected SonicWall Secure Mobile Access devices. SonicWall has released patches for both vulnerabilities. The SMA product line has historically been targeted by ransomware groups and featured in top routinely exploited vulnerabilities lists.