The company said there are no defensive workarounds for the flaws that include one enabling unauthenticated remote attacks; it has issued patches.
SonicWall on Monday reported two major security holes in its Secure Mobile Access 1000 series appliances, both of which it said are being actively exploited, and published patches for each. Consultants called the holes, one of which permits remote attacks that bypass authentication, highly troubling.
In its security alert, SonicWall described the first hole, tracked as CVE-2026-83548 and rated 10 (critical) in severity, as a “Pre-authentication SSRF vulnerability [that] exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.”
The alert described the second hole (CVE-2026-83549), in the SMA1000 Appliance Management Console (AMC), as one allowing an attacker to impersonate an administrator and to then “execute arbitrary OS commands, resulting in remote code execution.” Its severity rating is 7.8 (High).
There is no workaround for either bug, which affects versions 12.4.3-03453 and 12.5.0-02835 of the firmware. The company advised customers to contact technical support for assistance in determining whether a device has already been compromised.
Swift patching recommended
Cybersecurity consultants and specialists encouraged IT and cybersecurity teams to patch as quickly as possible, given the nature of these holes.
Mike Wilkes, enterprise CISO at Aikido Security, said the potential for an attacker gaining full system control, not just access, is frightening.
“SonicWall’s own recommendation to re-image compromised appliances and reset user and administrator passwords and TOTP tokens illustrates how seriously that possibility should be taken,” he said, adding that SonicWall’s recent past should encourage CISOs to move quickly.
“These are as critical as it gets. I would classify them as red hot and require immediate attention,” added Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group.
He said the reason he sees these holes as so severe is partly due to the nature of how the SMA1000, a secure mobile access appliance, is deployed, and how accessible it is to random Web visitors.
“CVE-2026-83548 allows a threat actor to perform any changes to the system without the need for any authentication. In a nutshell, an attacker could connect to the system and modify security configuration settings without needing valid credentials,” Villanustre said. “This vulnerability completely subverts the controls, provides an attacker with a wide range of opportunities, and allows them to establish persistence after the vulnerability is fixed.”
Cybersecurity consultant Brian Levine, executive director of FormerGov, agreed.
The pre-authentication SSRF “lets an unauthenticated attacker reach controls they should never touch, and the command injection flaw converts that reach into full code execution on the appliance,” Levine said. “Because these boxes sit at the network edge and broker remote access, the worst case is an attacker owning a trusted gateway and pivoting straight into the internal network, stealing credentials and configurations, planting persistence and moving laterally.”
Philip Harris, an IDC research director, concurred with Levine’s assessment.
“These two holes are about as serious as it gets for an edge access appliance, and the fact that SonicWall is disclosing them as already under active exploitation removes any question about whether this is theoretical,” he said.
On its own, the pre-authentication SSRF lets an outsider reach internal functionality that the appliance was never supposed to expose, Harris noted. “Paired with the OS command injection in the Appliance Management Console, the two form a chain: the unauthenticated SSRF gets an attacker into position to trigger the command injection flaw, and the end result is remote code execution, in practice as root, on a device that sits at the perimeter of the network by design.”
Repeats a June attack chain
What makes this issue especially significant is the timing and the pattern, he pointed out. “This is essentially a rerun of what happened with the same appliance line just weeks ago,” he said, citing the July disclosure of a “nearly identical” SSRF-plus-command-injection chain in SMA1000 that researchers at Volexity traced to exploitation starting June 22, weeks before a patch existed.
“That earlier chain was picked up by a threat cluster tracked as UTA0533 and then weaponized at scale by the INC ransomware operation, which has claimed roughly 900 victims globally since,” he noted. In those operations, attackers were harvesting local credentials, session databases, and TOTP MFA seeds to gain persistent, hard-to-evict access before moving laterally into victim networks.
And, Wilkes pointed out, that hasn’t been the only reported vulnerability; there have been 18 – 22 publicly disclosed CVEs impacting SonicWall products over the past 12 months, resulting in other cybersecurity issues which have included ransomware attacks.
He quipped, “it’s a bit tongue-in-cheek to remark that, from a product stickiness point of view, it’s not a great feature that your PSIRT portal is getting more traffic than the rest of your website.”
This article originally appeared on Network World.