SonicWall SMA1000, post-auth OS command injection in Appliance Management Console, actively exploited

CVE-2026-83548 / CVE-2026-83549, SonicWall SMA1000: a pre-auth SSRF through an unintended alternate Work Place access path chains into post-auth command injection in the Management Console, both under active exploitation

SonicWall's SMA1000 is a secure remote-access appliance family used by enterprises and government agencies to front VPN, SSL-VPN and application-proxy access for remote users. SonicWall's advisory SNWLID-2026-0016 (updated 2026-09-01) discloses two flaws it states it has investigated as actively exploited (SonicWall PSIRT). CVE-2026-83548 (CVSS 3.0 10.0) is a pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface, arising from an unintended alternate access path (CWE-918 SSRF, CWE-441 Confused Deputy); a remote, unauthenticated attacker uses it to reach functionality normally gated behind authentication (SonicWall PSIRT). CVE-2026-83549 (CVSS 3.0 7.8) is a post-authentication OS command injection in the Appliance Management Console (AMC), letting an attacker who already holds administrative access execute arbitrary operating-system commands (SonicWall PSIRT). Chained, the SSRF supplies the unauthorized access the command injection then turns into code execution: SecurityWeek says SonicWall has observed exploitation of both flaws, which suggests they have been chained in attacks (SecurityWeek, 2026-09-02), and BleepingComputer reports threat actors chaining the two zero-days (BleepingComputer, 2026-09-02). Affected: SMA1000 models 6210, 7210 and 8200v on any release before the fixed hotfixes below; the SMA 100 Series and SonicWall firewall SSL-VPN are explicitly not affected (SecurityWeek, 2026-09-02). Fixed in hotfix 12.4.3-03526 or 12.5.0-02952 (SecurityWeek, 2026-09-02). Shadowserver tracks more than 400 SMA1000 appliances exposed to the internet, some of which may already be patched (BleepingComputer, 2026-09-02). CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2026-09-02 (CISA Known Exploited Vulnerabilities catalog, 2026-09-02).

This is the second SMA1000 zero-day chain disclosed in seven weeks: in July, CVE-2026-15409 and CVE-2026-15410 were exploited as zero-days for weeks, in attacks that CISA linked to ransomware gangs (BleepingComputer, 2026-10-07). No source cited here ties this new chain to a named actor; the recurrence is in the vulnerability class and product line, not in a confirmed shared operator.

SonicWall's own remediation guidance where indicators of compromise are found is unusually direct: re-image or re-deploy the appliance, change every user and administrator password, and reset TOTP tokens, which implies that successful exploitation compromises stored credentials and MFA seeds, not just the appliance itself (BleepingComputer, 2026-09-02; The Hacker News, 2026-10-07).

Builds on: SonicWall confirms active exploitation of an unauthenticated SMA1000 SSRF chained to code…