Patch SonicWall SMA1000 now — two exploited flaws chain to remote code execution

If your office uses a SonicWall SMA1000-series appliance for remote access — the SMA 6210, 7210, or 8200v — this is not a patch you can leave for next month. SonicWall disclosed two vulnerabilities on September 1, 2026, confirmed both are being exploited in the wild, and CISA added them to its Known Exploited Vulnerabilities (KEV) catalog the next day. Attackers appear to have been using them before the public disclosure, which changes the response: patching alone isn’t enough, and you also need to check whether you were already hit.

This is the SMA1000 line, SonicWall’s higher-end remote-access appliance, not the smaller SMA 100 series (SMA 210/410/500v). Check which line you run before deciding you’re clear.

What’s vulnerable

Two flaws, tracked as CVE-2026-83548 and CVE-2026-83549, affect SMA1000 appliances running the 12.4.3 or 12.5.0 firmware branches:

• CVE-2026-83548 (CVSS 10.0, critical): an unauthenticated server-side request forgery (SSRF) in the appliance’s Work Place portal. No login is required.
• CVE-2026-83549 (CVSS 7.8, high): an OS command injection in the Appliance Management Console (AMC), the administrative interface. This one requires an authenticated administrator session to trigger directly.

The two can be chained: the unauthenticated SSRF gives an attacker a path to functionality that would otherwise require that admin session, turning the pair into unauthenticated remote code execution on the appliance. SonicWall has not published a workaround for either issue — the fix is the firmware update.

What to do today

1. Check your firmware version in the AMC. If you’re on the 12.4.3 branch, you need 12.4.3-03526 or later. If you’re on 12.5.0, you need 12.5.0-02952 or later. If you don’t manage the appliance day to day, ask whoever does (an MSP, a VAR) to confirm the exact build today, not “sometime this week.”
2. Update to the fixed build. There’s no supported workaround short of the update.
3. Restrict access to the AMC to a management network or VPN, not the open internet, regardless of patch status. That removes the precondition CVE-2026-83549 needs even if a future flaw shows up in the same interface.
4. Assume compromise is possible if you were exposed before patching. Because exploitation predates disclosure, SonicWall is directing affected customers to contact its Technical Support for an indicator-of-compromise review rather than treating a clean-looking system as automatically fine. If anything turns up, follow SonicWall’s recovery guidance: that has included rebuilding or redeploying the appliance, changing user and administrator passwords, and resetting TOTP/MFA tokens rather than just patching in place.

If you’re not sure whether your deployment is internet-facing, don’t guess. Check your firewall rules for the appliance’s public IP, or ask whoever manages the perimeter to confirm before you decide this doesn’t apply to you.

Why this matters here

CISA’s KEV listing set September 5, 2026 as the remediation deadline for federal civilian agencies. That deadline doesn’t bind county offices, police departments, or community banks directly, but KEV entries exist because CISA has evidence of real-world exploitation — it’s a reasonable proxy for “attackers are actively looking for this,” whoever holds the network. Remote-access appliances are exactly the kind of internet-facing gear that gets found by automated scanning within hours of a flaw becoming public, so the gap between “I’ll get to it” and “someone already tried” can be short.

If you’re doing a broader review of internet-facing remote-access and phone gear while you’re at it, the same logic applies to locking down an exposed on-prem phone system: anything that accepts connections from the public internet needs a patching cadence and a “is this actually supposed to be exposed” check, not just a firewall rule from years ago that nobody has revisited.

Sources

• SonicWall Product Notice SNWLID-2026-0016: SMA 1000 Series affected by Multiple Vulnerabilities — the vendor advisory with affected models, fixed builds, and remediation guidance.
• Rapid7: Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild — CVSS scores, exploitation timeline, and IOC-review recommendation.
• SecurityWeek: SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks — corroborating detail on the two CVEs and exploitation status.
• Cyber Security Agency of Singapore: Active Exploitation of Vulnerabilities in SonicWall SMA1000 Series — government advisory confirming active exploitation and lack of a workaround.