cyber.hendryadrian.com
Vulnerability & Exploit · cyberscoop.com

SonicWall Patches Two Actively Exploited SMA 1000 Zero-Days

· Original article ↗

Summary

SonicWall patched two actively exploited SMA 1000 zero-days that researchers say can be chained for unauthenticated remote-code execution. CISA added both to its KEV catalog; the vendor advised customers to hunt for compromise and reset credentials and tokens.

Key points

  • The vulnerabilities are CVE-2026-83548, a pre-authentication server-side request forgery flaw, and CVE-2026-83549, an OS command injection flaw.
  • Rapid7 researchers said the flaws can be chained to achieve unauthenticated remote-code execution.
  • SonicWall disclosed and patched both flaws, which it said were actively exploited in the wild.
  • CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog.
  • SonicWall did not specify the number of affected customers, when exploitation began, or a threat group responsible.
  • The vendor advised customers to hunt for compromise and, if detected, reimage or redeploy affected appliances, change passwords, and reset tokens.

Article Details

Vulnerability Types
  • Server-side request forgery
  • OS command injection
Severity
CVE-2026-83548 is described as max-severity; CVE-2026-83549 is described as high-severity.
Affected Versions
  • SonicWall SMA 1000
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Contact SonicWall technical support for assistance reviewing IOCs and hunting for signs of compromise.
  • If compromise is detected, reimage or redeploy the appliance, change all user and administrator passwords, and reset tokens.

MITRE ATT&CK

T1059 · Command and Scripting InterpreterThe OS command injection vulnerability can be chained with the server-side request forgery vulnerability to achieve unauthenticated remote-code execution.T1190 · Exploit Public-Facing ApplicationThe vulnerabilities in SonicWall SMA 1000 appliances were actively exploited to gain access through the network-facing appliances.

CVE

CVE-2026-83548SonicWall has disclosed and patched two actively exploited zero-day vulnerabilities, CVE-2026-83548 and CVE-2026-83549, in its SMA 1000 appliances after researchers said they could be chained to achieve unauthenticatedCVE-2026-83549has disclosed and patched two actively exploited zero-day vulnerabilities, CVE-2026-83548 and CVE-2026-83549, in its SMA 1000 appliances after researchers said they could be chained to achieve unauthenticated

People

Jake KnottHead of threat intelligence at watchTowr; commented on the disclosure and the chained vulnerabilities.

Threat Actors

AkiraNamed as a ransomware group that has targeted SonicWall.INC RansomNamed as a ransomware group that has targeted SonicWall.

Vendors

SonicWallSonicWall has disclosed and patched two actively exploited zero-day vulnerabilities, CVE-2026-83548 and CVE-2026-83549, in its SMA 1000 appliances after researchers said they could be chained to achieve unauthenticated

Products

SonicWall SMA1000and patched two actively exploited zero-day vulnerabilities, CVE-2026-83548 and CVE-2026-83549, in its SMA 1000 appliances after researchers said they could be chained to achieve unauthenticated remote-code execution.

Related Articles