Full Report
SonicWall disclosed this week that attackers are chaining two previously unknown vulnerabilities in its SMA1000 secure access appliances to run commands on unpatched devices, and urged customers to install an emergency hotfix. The more severe flaw, CVE-2026-83548, is a pre-authentication server-side request forgery weakness in the appliance's Appliance Work Place interface, rated 10.0 on the CVSS scale. It lets a remote attacker with no credentials reach sensitive internal functionality. The second, CVE-2026-83549, is an operating-system command injection bug in the Appliance Management Console rated 7.8; on its own it requires administrative authentication, but paired with the SSRF flaw it yields remote code execution. The vendor said it found both issues internally and then observed them being used together in live attacks. SonicWall has not published indicators of compromise or described the attackers. Affected products are the SMA1000 series 6210, 7210 and 8200v, in both hardware and virtual form. Fixed builds are 12.4.3-03526 and later, and 12.5.0-02952 and later. SonicWall firewalls running SSL-VPN and the separate SMA 100 line are not affected. Remediation guidance goes beyond patching. SonicWall told customers to contact its support organization to review appliances for signs of intrusion and, where compromise is suspected, to re-image or redeploy the device, rotate all credentials and reset TOTP tokens — an acknowledgment that one-time-password seeds stored on a breached appliance survive a software update. The company said customers should move to the hotfix release as quickly as possible. Shadowserver Foundation scanning has tracked more than 400 internet-exposed SMA1000 appliances, though an unknown share of those are already patched. The small install base belies the risk profile. These are remote-access gateways that sit at the network edge and hold credentials for the environments behind them. The disclosure extends a difficult run for the product line. Attackers exploited a separate pair of SMA1000 zero-days in July 2026, tracked as CVE-2026-15409 and CVE-2026-15410, to deploy custom malware; CISA later confirmed ransomware operators were abusing that access. Read: CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation Another zero-day surfaced in December 2025. Seventeen SonicWall vulnerabilities across the company's product families currently sit in CISA's Known Exploited Vulnerabilities catalog. Edge appliances from SonicWall, Ivanti, Citrix and Fortinet have collectively become the preferred initial-access route for ransomware affiliates and espionage crews, because they are internet-facing by design and rarely instrumented with endpoint detection.
Analysis Summary
# Vulnerability: SonicWall SMA1000 Series RCE Chain
## CVE Details
* **CVE ID:** CVE-2026-83548
* **CVSS Score:** 10.0 (Critical)
* **CWE:** Server-Side Request Forgery (SSRF)
* **CVE ID:** CVE-2026-83549
* **CVSS Score:** 7.8 (High)
* **CWE:** OS Command Injection
## Affected Systems
* **Products:** SonicWall SMA1000 series (Hardware and Virtual appliances)
* **Models:** 6210, 7210, and 8200v
* **Versions:** All versions prior to the emergency hotfix builds
* **Configurations:** Specifically impacts the **Appliance Work Place** interface (SSRF) and the **Appliance Management Console** (Command Injection).
## Vulnerability Description
This threat involves a vulnerability chain of two zero-day flaws. **CVE-2026-83548** is a pre-authentication SSRF in the Appliance Work Place interface that allows a remote, unauthenticated attacker to access sensitive internal functionality. This access is then used to reach the **CVE-2026-83549** OS command injection bug in the Management Console. While the command injection normally requires administrative credentials, the SSRF bypasses this requirement, resulting in unauthenticated Remote Code Execution (RCE) at the system level.
## Exploitation
* **Status:** Actively exploited in the wild (Zero-day).
* **Complexity:** Low (When chained).
* **Attack Vector:** Network (Remote).
## Impact
* **Confidentiality:** Total (Attacker can access all data and stored credentials).
* **Integrity:** Total (Attacker can execute arbitrary commands and modify system files).
* **Availability:** Total (Attacker can disrupt service or shut down the appliance).
## Remediation
### Patches
SonicWall has released emergency hotfixes. Customers should upgrade to the following builds or later:
* **12.4.3-03526**
* **12.5.0-02952**
### Workarounds
No specific software workarounds were provided; immediate patching is the only recommended preventative measure. SonicWall notes that SMA 100 series and firewalls running SSL-VPN are **not** affected.
## Detection
* **Indicators of Compromise:** SonicWall has not yet released specific file hashes or C2 IP addresses.
* **Detection Methods:**
* Contact SonicWall Support for a formal review of appliance logs for signs of intrusion.
* **Post-Compromise Actions:** If compromise is suspected, patching is insufficient. Administrators must:
1. Re-image or redeploy the virtual/physical appliance.
2. Rotate all administrative and user credentials.
3. Reset all TOTP (Time-based One-Time Password) tokens, as seeds stored on the device may have been exfiltrated.
## References
* **Vendor Advisory:** SonicWall Product Security Notice (Consult SonicWall Support Portal)
* **CISA KEV Catalog:** hxxps[://]www.cisa.gov/known-exploited-vulnerabilities-catalog
* **News Coverage:** hxxps[://]thecyberexpress[.]com/sonicwall-warns-of-two-zero-days-in-sma1000/