Overview
On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution (RCE) on affected appliances.
CVE-2026-83548 is a critical pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. The flaw has a CVSS v3.1 base score of 10.0 and can allow a remote, unauthenticated attacker to access sensitive functionality and perform unauthorized operations through an unintended alternate access path.
CVE-2026-83549 is a high-severity OS command injection vulnerability in the Appliance Management Console (AMC). On its own, exploitation requires an authenticated administrator and specific system conditions. Although, by leveraging the SSRF vulnerability CVE-2026-83548 an attacker could potentially exploit CVE-2026-83549 to execute arbitrary OS commands without prior authentication.
SonicWall SMA1000 appliances are enterprise secure remote access gateways used to provide employees and other authorized users with access to internal applications and resources. Their role as network-edge systems makes successful exploitation particularly concerning, since affected Work Place interfaces may be exposed directly to the internet as part of normal deployment.
SonicWall has confirmed active exploitation of both vulnerabilities in the wild, and both CVE-2026-83548 and CVE-2026-83549 have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. No public proof-of-concept exploit, indicators of compromise (IOCs), or attribution for the current activity were identified in the research available at the time of publication.
The vulnerabilities affect SMA1000 Models - 6210, 7210, 8200v running the following versions:
Vulnerable Versions | Fixed Versions |
12.4.3-03453 platform-hotfix and earlier | 12.4.3-03526 (platform-hotfix) and higher versions |
12.5.0-02835 platform-hotfix and earlier | 12.5.0-02952 (platform-hotfix) and higher versions. |
Mitigation guidance
Organizations operating affected SonicWall SMA1000 appliances should prioritize applying SonicWall’s updated platform hotfixes immediately. Because exploitation was occurring before public disclosure, organizations should not rely solely on patching to determine whether an appliance has already been compromised.
SonicWall recommends upgrading affected appliances to:
12.4.3-03526 platform-hotfix, for systems on the 12.4.3 branch
12.5.0-02952 platform-hotfix, for systems on the 12.5.0 branch
Affected Product/Component:
SonicWall SMA1000 Appliance Work Place and Appliance Management Console
Version 12.4.3-03453 platform-hotfix and earlier are affected.
Version 12.5.0-02835 platform-hotfix and earlier are affected.
SonicWall additionally recommends that customers contact SonicWall Technical Support for assistance reviewing appliances for indicators of compromise.
If evidence of compromise is identified, SonicWall recommends:
Re-imaging affected hardware appliances or re-deploying affected virtual appliances.
Changing all user and administrator passwords.
Resetting Time-based One-Time Password (TOTP) tokens.
Given the confirmed exploitation of these vulnerabilities, organizations should treat potentially exposed appliances running vulnerable software as a priority for investigation as well as remediation.
Please read the SonicWall security advisory for the latest vendor guidance.
Rapid7 customers
Exposure Command, InsightVM, and Nexpose
Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-83548 and CVE-2026-83549 in the SMA1000 Appliance series with vulnerability checks expected to be available in the September 3rd content release.
Updates
September 2, 2026: Initial publication.
- September 3, 2026: CVE added to CISA KEV.