Vulnerabilities

CISA Flags Two Actively Exploited SonicWall SMA1000 Vulnerabilities

SonicWall SMA1000 vulnerabilities added to CISA's catalog: two chainable flaws demand urgent action from federal agencies by September 5, 2026.

By Content Team

Sep 3, 2026

ON THIS PAGE

CISA added two SonicWall SMA1000 vulnerabilities to its Known Exploited Vulnerabilities catalog on September 2, 2026, giving federal agencies just three days to act. SonicWall disclosed both as zero-days after finding them under active exploitation.

CVE-2026-83548 (CVSS 10.0, Critical) is a pre-authentication SSRF flaw in the Appliance Work Place interface. CVE-2026-83549 (CVSS 7.8, High) is an OS command injection in the Appliance Management Console that normally requires admin authentication. Chained, the SSRF supplies that access — turning the pair into unauthenticated remote code execution.

SonicWall says it has seen exploitation of both, which points to chaining, and that no public proof-of-concept exists. Affected models are the 6210, 7210, and 8200v; the fix is hotfix 12.4.3-03526 or 12.5.0-02952 and higher.

SMA1000 appliances handle enterprise remote access, making them high-value targets. CISA has flagged both under Binding Operational Directive 26-04, requiring forensic triage — not just patching. Audit admin activity, check for new accounts, and review outbound connections. If you find signs of compromise, SonicWall says to re-image, rotate all passwords, and reset TOTP tokens.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?