SonicWall SMA 1000 Under Active Attack: Two Zero-Days Enable SSRF and Remote Code Execution
Summary
SonicWall has patched two actively exploited zero-day vulnerabilities, CVE-2026-83548 and CVE-2026-83549, affecting its SMA 1000 Series secure access appliances. CVE-2026-83548 is a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the Appliance Work Place interface with a CVSS score of 10.0 (Critical). The flaw exposes an unintended forward-proxy capability that allows a remote, unauthenticated attacker to access sensitive functionality and perform unauthorized operations. CVE-2026-83549, rated 7.8 (High), is a post-authentication operating-system command injection vulnerability in the Appliance Management Console (AMC) that can allow an authenticated administrator to execute arbitrary operating-system commands and achieve remote code execution under specific conditions.
SonicWall has confirmed that both vulnerabilities are being actively exploited in the wild, with its investigation indicating that attackers may be chaining the two flaws to compromise vulnerable SMA 1000 appliances and achieve arbitrary code execution. The vulnerabilities affect SMA 6210, 7210, and 8200v appliances running vulnerable firmware versions. Given the ongoing exploitation, organizations using affected SMA 1000 appliances should prioritize upgrading to the fixed firmware and investigate exposed systems for indicators of compromise.
Vulnerability Details
| CVE ID | CVSS Score | EPSS Score | Affected Products | Vulnerability Type |
|---|---|---|---|---|
| CVE-2026-83548 | 10.0 (Critical) | 0.27% | SonicWall SMA 1000 - 6210, 7210, and 8200v | Server-Side Request Forgery (SSRF) |
| CVE-2026-83549 | 7.8 (High) | 0.92% | SonicWall SMA 1000 - 6210, 7210, and 8200v | OS command injection / Remote Code Execution |
Impact
- Unauthenticated Access to Sensitive Functionality: CVE-2026-83548 can allow a remote attacker without valid credentials to abuse the Appliance Work Place interface and access sensitive functionality or perform unauthorized operations.
- Arbitrary Command Execution: CVE-2026-83549 can allow an authenticated administrator to inject and execute arbitrary operating-system commands on the affected SMA 1000 appliance.
- Remote Code Execution Through Vulnerability Chaining: Attackers may chain CVE-2026-83548 and CVE-2026-83549 to progress from unauthenticated exploitation to arbitrary code execution on vulnerable appliances.
- Compromise of Remote-Access Infrastructure: Successful exploitation could compromise an organization's internet-facing SMA appliance, potentially giving attackers control over security-critical remote-access infrastructure.
- Credential and Authentication Risk: Compromise of an SMA appliance may expose user or administrator credentials and authentication material, increasing the risk of additional unauthorized access.
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1090 | Proxy | Command and Control |
| T1090.001 | Internal Proxy | Command and Control |
| T1059 | Command and Scripting Interpreter | Execution |
| T1059.004 | Unix Shell | Execution |
| T1078 | Valid Accounts | Defense Evasion / Initial Access |
| T1210 | Exploitation of Remote Services | Lateral Movement |
Mitigation
-
Apply the SonicWall hotfix immediately.
Organizations running affected SMA 1000 appliances should upgrade from12.4.3-03453or earlier to12.4.3-03526or later, or from12.5.0-02835or earlier to12.5.0-02952or later. -
Prioritize internet-facing SMA 1000 appliances.
Because CVE-2026-83548 is remotely exploitable before authentication and both vulnerabilities are confirmed to be actively exploited, public-facing appliances should be patched on an emergency basis rather than waiting for the normal maintenance window. -
Contact SonicWall Technical Support for compromise assessment.
Customers should contact SonicWall Technical Support for assistance reviewing affected systems for indicators of compromise, particularly when appliances were exposed while running vulnerable firmware. -
Re-image compromised hardware appliances.
If indicators of compromise are identified, re-image affected hardware appliances rather than assuming that applying the firmware update alone removes attacker access.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
