SonicWall's SMA 1000 appliances hit by two actively exploited zero-days: what to patch, and how fast
On 1 September SonicWall disclosed two zero-days in its SMA 1000 remote-access appliances, one of them a maximum-severity flaw, and both, SonicWall says, already under attack. CISA gave federal agencies just three days to fix them. Here is exactly what is affected, what is not, and the builds you need.
SonicWall disclosed two zero-day vulnerabilities in its SMA 1000 series remote-access appliances on 1 September 2026, and says both are already being exploited in the wild. The more serious, CVE-2026-83548, is an unauthenticated server-side request forgery flaw rated the maximum CVSS 10.0; the second, CVE-2026-83549, is an authenticated command-injection bug rated 7.8. Chained, they could give an unauthenticated attacker remote code execution. The fix is to install SonicWall's platform hotfix now: version 12.4.3-03526 or 12.5.0-02952, or later, depending on your branch. Only the SMA 1000 line is affected, not the SMA 100 series or SonicWall firewall SSL-VPN. CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2 September and set a federal patch deadline of 5 September.
If you run a SonicWall SMA 1000 appliance, this is a stop-what-you-are-doing advisory. On 1 September 2026 SonicWall's product security team published advisory SNWLID-2026-0016, covering two vulnerabilities that it says have already been seen in real attacks. One of them carries the highest severity score the scale allows. Below is the careful version: the two flaws, what "actively exploited" does and does not mean here, exactly which hardware is in scope, and the precise builds that close the hole.
What are the two vulnerabilities?
There are two separate bugs, in two different parts of the appliance, and they matter most when combined.
- CVE-2026-83548 is a server-side request forgery (SSRF) flaw in the SMA 1000 Appliance Work Place interface. It is unauthenticated, meaning an attacker does not need to log in first, and it is rated CVSS 10.0, the maximum. SonicWall says it could let an attacker "gain unauthorized access to sensitive functionality and perform unauthorized operations."
- CVE-2026-83549 is an operating-system command-injection flaw in the Appliance Management Console. It is authenticated, requiring administrator credentials, and is rated CVSS 7.8. SonicWall says it could "enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
Both were credited to SonicWall's own researchers, William Perry and Adam Babis.
| CVE-2026-83548 | CVE-2026-83549 | |
|---|---|---|
| Type | Server-side request forgery (SSRF) | OS command injection |
| Component | Appliance Work Place | Appliance Management Console |
| CVSS score | 10.0 (critical) | 7.8 (high) |
| Authentication | None (pre-auth) | Administrator (post-auth) |
| Actively exploited | Yes, per SonicWall | Yes, per SonicWall |
Note that the 10.0 score belongs to the SSRF alone; it is that bug's own rating, not a score for the two used together. There is no single published figure for the full chain.
Why chaining them is the real danger
On their own, neither bug is the full picture. The SSRF needs no login and is rated maximum severity for its potential impact, but on its own it is a request-forgery primitive; the command injection can run code directly but requires an administrator login first. The concern that has security teams moving quickly is that the two are assessed to fit together: the unauthenticated SSRF can reach functionality that would normally sit behind authentication, and chaining it with the command-injection bug points toward unauthenticated remote code execution, the most severe outcome an appliance like this can suffer. SonicWall has not published the exact chaining mechanism.
Here is the honest boundary between confirmed and reported. SonicWall states plainly that both vulnerabilities are under active exploitation, and independent responders are relaying that confirmation: Rapid7's emergency write-up notes that "SonicWall has confirmed active exploitation of both vulnerabilities in the wild." What is not yet public is a proof-of-concept exploit or a list of indicators of compromise, so the specific "chained to full unauthenticated code execution in live attacks" picture is best read as vendor-observed and strongly reported rather than something an outsider has independently reproduced. Either way, the defensive action is identical, and urgent.
Which devices are affected, and which are not
This is the part it is easy to get wrong, because SonicWall sells several remote-access products with similar names.
- Affected: the SMA 1000 series only. The confirmed models are the 6210, 7210 and 8200v, covering both physical and virtual appliances.
- Not affected: the SMA 100 series. That is a separate product line and is not in scope for these two CVEs.
- Not affected: SSL-VPN on SonicWall firewalls. The firewall SSL-VPN feature is a different codebase and is not covered by this advisory.
If your remote access runs on an SMA 100 or through a firewall's SSL-VPN, these two specific bugs do not apply to you, though normal patch hygiene still does.
How to fix it
There is no configuration toggle that mitigates this. Patching is the remedy, and the fixed build depends on which branch you are on.
- 12.4.3 branch: update to 12.4.3-03526 (platform hotfix) or later.
- 12.5.0 branch: update to 12.5.0-02952 (platform hotfix) or later.
SonicWall's guidance is to apply the platform hotfix immediately and to contact its technical support to check your appliance for indicators of compromise. If you find evidence that a device was already breached, the recommended response is to re-image the appliance (or redeploy the virtual appliance from clean media), reset all passwords and credentials, and reset the one-time-password (TOTP) tokens, on the assumption that anything on a compromised box may be in an attacker's hands.
Why the three-day deadline matters
On 2 September 2026, the day after disclosure, the US Cybersecurity and Infrastructure Security Agency added both CVEs to its Known Exploited Vulnerabilities catalog and set a remediation deadline of 5 September for federal civilian agencies. That is a roughly three-day window, far tighter than the multi-week deadlines KEV entries usually carry, and it carries two signals: inclusion in the catalog means exploitation is confirmed, and the unusually short window suggests how urgent the agency judges an unauthenticated, maximum-severity bug on an internet-facing gateway to be. The KEV deadline is binding only on those agencies, but it is a good barometer of urgency for everyone else. There is no confirmed attribution for who is behind the attacks, and none should be assumed.
The wider pattern is familiar: remote-access and edge appliances remain among the most-targeted enterprise assets, the same story running through recent KEV-listed flaws in Oracle WebLogic and the Ray AI framework. For more, see our full software coverage.
Frequently asked questions
Which SonicWall products are affected by CVE-2026-83548 and CVE-2026-83549?
Only the SonicWall SMA 1000 series (confirmed models 6210, 7210 and 8200v, physical and virtual). The SMA 100 series and SSL-VPN on SonicWall firewalls are not affected by these two vulnerabilities.
What version fixes the SonicWall SMA 1000 zero-days?
Install the platform hotfix for your branch: 12.4.3-03526 or later on the 12.4.3 branch, or 12.5.0-02952 or later on the 12.5.0 branch. There is no configuration workaround; patching is the fix.
Are these SonicWall vulnerabilities actually being exploited?
Yes. SonicWall says both CVE-2026-83548 and CVE-2026-83549 are under active exploitation, and CISA added both to its Known Exploited Vulnerabilities catalog on 2 September 2026. A public proof-of-concept and indicators of compromise had not been released at disclosure.
What should I do if I think my appliance was compromised?
SonicWall advises contacting its support to check for indicators of compromise, and, if a device is compromised, re-imaging or redeploying the appliance, resetting all passwords and credentials, and resetting TOTP tokens.
How severe is CVSS 10.0, and what does it apply to here?
CVSS 10.0 is the maximum severity on the scale. Here it applies to CVE-2026-83548, the unauthenticated SSRF flaw, on its own. The second bug carries its own 7.8 rating, and there is no separate published score for the two chained together.
That maximum-severity Oracle WebLogic flaw with a three-day deadline is not a new zero-day
On 24 August, CISA added a CVSS 10.0 Oracle flaw, CVE-2026-21962, to its Known Exploited list with a three-day federal deadline. It reads like an emergency zero-day but is not: Oracle patched it in January 2026. What changed is the KEV listing, not the bug or the fix.
A Ray AI-framework bug got a rare three-day federal patch order. Here is what CVE-2025-62593 actually is, and what it is not
On 17 August, CISA added a critical Ray flaw, CVE-2025-62593, to its Known Exploited list with a three-day deadline; it lets a malicious web page reach a developer's local Ray dashboard and run code. It is narrower than the scary numbers, which belong to an older Ray bug.
Google has pulled uBlock Origin from the Chrome Web Store: what changed, and your best ad-blocker options now
On 31 August Google removed the last Manifest V2 extensions, uBlock Origin included, from the Chrome Web Store. It is the final step of a phase-out that has run since 2024, not a sudden ban. Here is what actually changed, why Google and its critics disagree, and where full uBO still runs.