cyber.hendryadrian.com
Vulnerability & Exploit · rapid7.com

SonicWall SMA1000 Flaws Exploited in the Wild Enable Unauthenticated RCE

· Original article ↗

Summary

SonicWall confirmed active exploitation of two SMA1000 vulnerabilities that can be chained for unauthenticated remote code execution. Organizations should install fixed hotfixes and investigate potentially exposed appliances for compromise.

Key points

  • CVE-2026-83548 is a critical pre-authentication SSRF flaw; CVE-2026-83549 is an OS command injection flaw that normally requires an authenticated administrator.
  • Chaining the flaws can enable unauthenticated remote code execution on affected SMA1000 appliances.
  • SonicWall confirmed active exploitation, and both vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog.
  • Affected models include the SMA1000 6210, 7210, and 8200v running versions 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier.
  • Install hotfix 12.4.3-03526 or later, or 12.5.0-02952 or later, as appropriate.
  • Patching alone may not reveal prior compromise; SonicWall recommends seeking support to review for indicators of compromise.
  • If compromise is found, SonicWall recommends re-imaging or redeploying affected appliances, changing user and administrator passwords, and resetting TOTP tokens.

Article Details

Vulnerability Types
  • Server-side request forgery (SSRF)
  • OS command injection
Severity
CVE-2026-83548 is critical (CVSS v3.1 score 10.0); CVE-2026-83549 is high severity.
Affected Versions
  • SMA1000: 12.4.3-03453 platform-hotfix and earlier
  • SMA1000: 12.5.0-02835 platform-hotfix and earlier
Exploitation Status
active
Exploit Availability
none_reported
Patch Status
available

CVE

CVE-2026-83548appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution (RCE) on affectedCVE-2026-83549the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution (RCE) on affected appliances.

Vendors

SonicWallOn September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549,

Products

Appliance Management ConsoleCVE-2026-83549 is a high-severity OS command injection vulnerability in the Appliance Management Console (AMC). On its own, exploitation requires an authenticated administrator and specific system conditions. Although,Appliance WorkPlaceis a critical pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. The flaw has a CVSS v3.1 base score of 10.0 and can allow a remote, unauthenticatedSMA1000On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549,

Related Articles