SonicWall SMA 1000 Zero-Days Actively Exploited, Hotfix Urged
Summary
SonicWall says attackers are exploiting two SMA 1000 zero-days: a pre-authentication SSRF and an OS command injection flaw that can enable admin-level RCE. The vendor urges hotfix installation and compromise checks.
Key points
- SonicWall confirmed a case indicating active exploitation of CVE-2026-83548 and CVE-2026-83549.
- CVE-2026-83548 is a pre-authentication SSRF flaw in the Appliance Work Place interface.
- CVE-2026-83549 is an OS command injection flaw in the Appliance Management Console; exploitation requires admin privileges and can lead to remote code execution.
- The vulnerabilities affect physical and virtual SMA 1000 models 6210, 7210, and 8200v; SMA 100 appliances and SonicWall firewalls are not affected.
- SonicWall urges customers to apply its hotfix and contact support to check for indicators of compromise.
- After a confirmed compromise, SonicWall advises re-imaging hardware or re-deploying virtual appliances, changing user and administrator passwords, and resetting TOTP tokens.
- SonicWall has not shared known indicators of compromise or further attack details.
Article Details
- Vulnerability Types
- Pre-authentication server-side request forgery (SSRF)
- OS command injection
- Affected Versions
- SMA 1000 6210
- SMA 1000 7210
- SMA 1000 8200v
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available