Email Security and management
CVE-2025-40604: Download of Code Without Integrity Check in Email Security
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Email Security (Linux, Windows) 10.0 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.