SonicWall SMA 1000 Under Active Attack: Two Zero-Days Enable SSRF and Remote Code Execution

Vulnerability Details

CVE ID	CVSS Score	EPSS Score	Affected Products	Vulnerability Type
CVE-2026-83548	10.0 (Critical)	0.27%	SonicWall SMA 1000 - 6210, 7210, and 8200v	Server-Side Request Forgery (SSRF)
CVE-2026-83549	7.8 (High)	0.92%	SonicWall SMA 1000 - 6210, 7210, and 8200v	OS command injection / Remote Code Execution

SonicWall identifies CVE-2026-83548 as a pre-authentication SSRF vulnerability caused by an unintended forward-proxy capability in the Appliance Work Place interface. The flaw has a maximum CVSS score of 10.0 and can be exploited remotely without authentication.

CVE-2026-83549 affects the Appliance Management Console (AMC). It is a post-authentication operating-system command injection vulnerability that can allow an authenticated administrator to execute arbitrary commands under specific conditions.

The combination of the two vulnerabilities is particularly concerning because the first vulnerability provides a pre-authentication attack surface, while the second provides a mechanism for operating-system command execution when its authentication and privilege requirements are satisfied.

Root Cause Analysis

CVE-2026-83548: Pre-Authentication SSRF

CVE-2026-83548 affects the SMA 1000 Appliance Work Place interface. SonicWall characterizes the vulnerability as a pre-authentication Server-Side Request Forgery through an unintended forward-proxy mechanism.

Server-Side Request Forgery occurs when an externally controlled request causes a server-side application to make network requests on behalf of an attacker. Because those requests originate from the trusted appliance, they can potentially reach services that are inaccessible directly from the internet.

The critical security implication is that the attacker does not need valid credentials before attempting to abuse the vulnerable interface. SonicWall assigns CVE-2026-83548 a CVSS score of 10.0.

CVE-2026-83549: Post-Authentication OS Command Injection

CVE-2026-83549 resides in the Appliance Management Console (AMC). The flaw allows an authenticated attacker operating with administrator privileges to inject operating-system commands under specific conditions.

Successful exploitation can result in arbitrary command execution and remote code execution on the SMA 1000 appliance. SonicWall rates the vulnerability 7.8 (High).

Although the second vulnerability requires authentication and administrator privileges, its significance increases when viewed alongside CVE-2026-83548. The two vulnerabilities can potentially be chained as part of a broader compromise path against vulnerable SMA 1000 appliances.

Impact

1. Unauthenticated Access to Sensitive Functionality: CVE-2026-83548 can allow a remote attacker without valid credentials to abuse the Appliance Work Place interface and access sensitive functionality or perform unauthorized operations.
2. Arbitrary Command Execution: CVE-2026-83549 can allow an authenticated administrator to inject and execute arbitrary operating-system commands on the affected SMA 1000 appliance.
3. Remote Code Execution Through Vulnerability Chaining: Attackers may chain CVE-2026-83548 and CVE-2026-83549 to progress from unauthenticated exploitation to arbitrary code execution on vulnerable appliances.
4. Compromise of Remote-Access Infrastructure: Successful exploitation could compromise an organization's internet-facing SMA appliance, potentially giving attackers control over security-critical remote-access infrastructure.
5. Credential and Authentication Risk: Compromise of an SMA appliance may expose user or administrator credentials and authentication material, increasing the risk of additional unauthorized access.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application	Initial Access
T1090	Proxy	Command and Control
T1090.001	Internal Proxy	Command and Control
T1059	Command and Scripting Interpreter	Execution
T1059.004	Unix Shell	Execution
T1078	Valid Accounts	Defense Evasion / Initial Access
T1210	Exploitation of Remote Services	Lateral Movement

Mitigation

1. Apply the SonicWall hotfix immediately.
   Organizations running affected SMA 1000 appliances should upgrade from 12.4.3-03453 or earlier to 12.4.3-03526 or later, or from 12.5.0-02835 or earlier to 12.5.0-02952 or later.
2. Prioritize internet-facing SMA 1000 appliances.
   Because CVE-2026-83548 is remotely exploitable before authentication and both vulnerabilities are confirmed to be actively exploited, public-facing appliances should be patched on an emergency basis rather than waiting for the normal maintenance window.
3. Contact SonicWall Technical Support for compromise assessment.
   Customers should contact SonicWall Technical Support for assistance reviewing affected systems for indicators of compromise, particularly when appliances were exposed while running vulnerable firmware.
4. Re-image compromised hardware appliances.
   If indicators of compromise are identified, re-image affected hardware appliances rather than assuming that applying the firmware update alone removes attacker access.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.