InfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
90
CVE-2026-83549
Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
CISA: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- CVSS 3.1
- 7.8 high
- EPSS
- 10%p96
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-83549 is a post-authentication OS command injection flaw (CWE-78) in the Appliance Management Console (AMC) of SonicWall SMA1000 appliances. An attacker who authenticates to the AMC with administrator privileges can, under specific conditions, inject arbitrary operating system commands and achieve remote code execution on the appliance. Only organizations running SMA1000-series appliances, including the SMA 6210, SMA 7210, and SMA 8200v models cited in the data, are affected. CISA added the flaw to the KEV catalog on 2026-09-02, and news reports describe active exploitation, possibly chained with companion zero-day CVE-2026-83548, with reverse shells and cryptocurrency miners observed; no public proof-of-concept is known. EPSS assigns an 8.5% probability of exploitation within 30 days (95th percentile).
What to do: Apply the fixed firmware from SonicWall advisory AV26-872 (Update 1) on all SMA1000-series appliances immediately, consistent with CISA's KEV required action and BOD 26-04 guidance. Restrict access to the AMC to trusted networks and audit administrator logins for unexpected sources. Hunt for signs of compromise, including reverse shells and cryptomining activity, and ensure companion flaw CVE-2026-83548 is remediated as part of the same update.
| Product | Affected |
|---|---|
| SonicWall SMA1000 series appliances - Appliance Management Console (AMC) | — |
| SonicWall SMA 6210 (SMA1000 series firmware) | — |
| SonicWall SMA 7210 (SMA1000 series firmware) | — |
| SonicWall SMA 8200v (SMA1000 series) | — |
Estimated exposure
moderateLikely on the order of 10,000-100,000 deployed SMA1000-series appliances, with a smaller subset exposing the AMC to the internet; exact counts unknown — This estimate reflects SonicWall SMA's broad enterprise deployment and public internet-exposure scans showing thousands to tens of thousands of SonicWall SMA appliances reachable online, though the SMA1000 line is a subset of the wider SMA…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
KEVCISA Known Exploited Vulnerability
- Affected
- SonicWall SMA1000 Appliances
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- sonicwall
- Products
- sma8200v, sma6210 firmware, sma7210 firmware
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news
20 storiesSonicWall Patches Two New Actively Exploited Zero
SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.
90
Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
SonicWall SMA1000 appliances face active exploitation of chained CVE-2026-83548 and CVE-2026-83549 enabling unauthenticated RCE; hotfixes released.
88
Max severity SonicWall SMA1000 flaw now exploited in attacks
Attackers exploit max-severity SonicWall SMA1000 flaw CVE-2026-102255 three days after patch; Previdian honeypots captured matching exploitation attempts.
85
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.
85
Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
SonicWall patches two actively exploited zero-days (CVE-2026-83548, CVE-2026-83549) in SMA 1000 VPN appliances, likely chained for code execution.
85
SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug
SonicWall disclosed a CVSS 10 pre-auth SSRF in SMA1000, with no confirmed exploitation yet.
82
Attackers exploit zero-days in consistently besieged SonicWall product
Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.
82
CISA Warns of SonicWall SMA1000 Vulnerabilities Active Exploitation (CVE-2026-83548 & CVE-2026-83549)
CISA added two actively exploited SonicWall SMA1000 flaws to KEV: pre-auth SSRF CVE-2026-83548 (CVSS 10) and post-auth RCE CVE-2026-83549; patch by September 5.
82
SonicWall security advisory (AV26-872) – Update 1
CISA added exploited SonicWall SMA1000 flaws CVE-2026-83548 and CVE-2026-83549 to KEV; admins of affected hotfix versions should patch.
80
SonicWall SMA 1000 appliances under attack via zero-day flaws
SonicWall confirms active exploitation of zero-day SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) flaws in SMA 1000 remote access appliances.
80
SonicWall's SMA1000 boxes under active attack again
SonicWall warns attackers are chaining two SMA1000 zero-days, a CVSS 10.0 SSRF and command injection, to compromise VPN gateways.
78
Hackers Chain Two New SonicWall Zero-Day Vulnerabilities
SonicWall warns two zero-days (CVE-2026-83548 SSRF, CVE-2026-83549 post-auth RCE) in SMA1000 appliances are being actively exploited.
78
SonicWall warns of max severity SSRF flaw in SMA1000 gateways
SonicWall patches maximum-severity unauthenticated SSRF CVE-2026-102255 in SMA1000 gateways; no exploitation reported.
76
SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10 pre-auth SSRF in SMA1000 appliances, with no evidence of exploitation.
74
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace plus three authenticated flaws.
74
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
72
7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
70
SonicWall Patches 4 SMA1000 Flaws, Including Critical Pre-Auth SSRF Rated CVSS 10
SonicWall patched four SMA 1000 flaws, including an unauthenticated SSRF rated CVSS 10.0.
68
Metasploit Wrap Up: This One Goes to Sixteen!
Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.
48