SonicWall Confirms Active Exploitation of Two SMA1000 Zero-Days
Summary
SonicWall says attackers are chaining CVE-2026-83548 and CVE-2026-83549 for remote code execution on SMA1000 6210, 7210 and 8200v appliances; it urges hotfixing and re-imaging if compromise is suspected.
Key points
- SonicWall says it investigated a case indicating active exploitation of the two flaws, which attackers are chaining for remote code execution.
- CVE-2026-83548 is a maximum-severity command injection flaw in the SMA1000 Appliance WorkPlace interface associated with an SSRF weakness.
- CVE-2026-83549 affects the Appliance Management Console and lets attackers with administrator privileges run arbitrary OS commands.
- Affected models are SMA1000 6210, 7210 and 8200v; SonicWall firewalls running SSL-VPN and the SMA 100 Series are not affected.
- SonicWall urges customers to install the latest hotfix. If indicators of compromise are detected, it advises re-imaging appliances, changing user and administrator passwords, and resetting TOTP tokens.
- SonicWall has not shared details of the ongoing attacks or the indicators of compromise found during its investigation.
- Shadowserver tracks more than 400 SMA1000 appliances exposed online, though some may already be patched.
Article Details
- Vulnerability Types
- Command injection
- Server-side request forgery (SSRF)
- Severity
- Maximum severity for CVE-2026-83548; severity for CVE-2026-83549 not specified
- Affected Versions
- SMA1000 6210
- SMA1000 7210
- SMA1000 8200v
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Upgrade virtual or physical SMA1000 appliances to the latest hotfix.
- If compromise is suspected, re-image affected appliances, change all user and administrator passwords, and reset TOTP tokens.
MITRE ATT&CK
CVE
CVE-2025-40602The company also warned customers in December to patch another SMA1000 zero-day vulnerability (CVE-2025-40602) that hackers were chaining to gain root privileges.CVE-2026-15409In July, two other SonicWall SMA1000 flaws (CVE-2026-15409 and CVE-2026-15410) were exploited in zero-day attacks for weeks to install custom malware on vulnerable VPN appliances.CVE-2026-15410In July, two other SonicWall SMA1000 flaws (CVE-2026-15409 and CVE-2026-15410) were exploited in zero-day attacks for weeks to install custom malware on vulnerable VPN appliances.CVE-2026-83548SonicWall warned that attackers are chaining two newly discovered SMA1000 zero-days, CVE-2026-83548 and CVE-2026-83549, to achieve remote code execution on exposed appliances.CVE-2026-83549SonicWall warned that attackers are chaining two newly discovered SMA1000 zero-days, CVE-2026-83548 and CVE-2026-83549, to achieve remote code execution on exposed appliances.
Vendors
Products
Industries
Critical infrastructureSuch vulnerabilities are often targeted in attacks, given that the SMA1000 is a secure remote access appliance used by large enterprises, government, and critical infrastructure organizations.GovernmentSuch vulnerabilities are often targeted in attacks, given that the SMA1000 is a secure remote access appliance used by large enterprises, government, and critical infrastructure organizations.Large enterprisesSuch vulnerabilities are often targeted in attacks, given that the SMA1000 is a secure remote access appliance used by large enterprises, government, and critical infrastructure organizations.