ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Threat actor

UTA0533

0 mentions in 7 days · 2 in 30 days · 2 total · first seen · last

Search everything

Timeline

SonicWall Patches Two New Actively Exploited Zero

SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.

SonicWall released hotfixes for two zero-day vulnerabilities in its SMA 1000 VPN appliances, with SonicWall PSIRT confirming active exploitation in the wild. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface allowing unauthenticated unauthorized operations; CVE-2026-83549 (CVSS 7.8) is a post-authentication OS command injection in the Appliance Management Console enabling arbitrary command execution and RCE. The flaws affect models 6210, 7210 and 8200v running 12.4.3-03453 or earlier and 12.5.0-02835 or earlier, fixed in versions 12.4.3-03526 and 12.5.0-02952. This follows a July Volexity report on threat actor UTA0533 chaining two SMA 1000 zero-days to gain root access and deploy the KNUCKLEBALL Python backdoor.

Security Affairs · 13d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549CVE-2026-15409+1 CVEs1

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

SonicWall patches two actively exploited zero-days (CVE-2026-83548, CVE-2026-83549) in SMA 1000 VPN appliances, likely chained for code execution.

SonicWall fixed CVE-2026-83548 (CVSS 10.0), a pre-authentication SSRF in the Appliance Work Place interface, and CVE-2026-83549 (CVSS 7.8), a post-authentication OS command injection in the Appliance Management Console. The company investigated a case indicating active exploitation, suggesting attackers chained both bugs to execute arbitrary code on susceptible devices. Affected SMA 1000 models 6210, 7210, and 8200v require hotfixes 12.4.3-03526 or 12.5.0-02952; customers are urged to hunt for IoCs and re-image, reset credentials, and rotate TOTP if found.

The Hacker News · 13d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549CVE-2026-15409+1 CVEs

Related CVEs

  • CVE-2026-1540910.085%
    Unauthenticated SSRF in SonicWall SMA1000 Appliances
    CVE-2026-15409 is a server-side request forgery (SSRF, CWE-918) in the Appliance Work Place interface of SonicWall SMA1000 series appliances. A remote, unauthenticated attacker can trigger the flaw over the network, causing the appliance to issue requests to attacker-influenced or unintended internal locations. Because the CVSS vector scores scope-changed impacts on confidentiality, integrity, and availability, the SSRF is assessed as capable of reaching sensitive internal services, and reporting indicates it is being used alongside a second SMA1000 zero-day in what may be an exploitation chain. Affected organizations are those running SMA1000 appliances, including SMA 6210, SMA 7210, and SMA 8200v models, which typically act as internet-facing remote-access/VPN gateways. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2026-07-14, ransomware use is known, and EPSS assigns an 83.7% probability of exploitation within 30 days, though no public PoC is available.
    · SonicWall SMA1000 Appliances (SMA 6210 firmware) · SonicWall SMA1000 Appliances (SMA 7210 firmware) KEV ransomwarelarge
  • CVE-2026-8354810.05%
    Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
    CVE-2026-83548 is a critical (CVSS 3.1 score 10.0) server-side request forgery (SSRF) vulnerability in the Workplace interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (unprotected alternate channel, CWE-441; SSRF, CWE-918). Because it is pre-authentication, any remote unauthenticated attacker who can reach the interface can trigger it and gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA lists all SonicWall SMA1000 appliances as affected, with CPE data naming the SMA 8200v and SMA 6210/7210 firmware; internet-exposed units are at highest risk. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-02 alongside companion zero-day CVE-2026-83549, which reporting suggests may form an attack chain with this SSRF. Exploitation probability is elevated (EPSS 4.7%, 91st percentile) and no public proof-of-concept is known.
    · SonicWall SMA1000 appliance Workplace interface · SonicWall SMA 8200v KEVmoderate
  • CVE-2026-835497.89%
    Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
    CVE-2026-83549 is a post-authentication OS command injection flaw (CWE-78) in the Appliance Management Console (AMC) of SonicWall SMA1000 appliances. An attacker who authenticates to the AMC with administrator privileges can, under specific conditions, inject arbitrary operating system commands and achieve remote code execution on the appliance. Only organizations running SMA1000-series appliances, including the SMA 6210, SMA 7210, and SMA 8200v models cited in the data, are affected. CISA added the flaw to the KEV catalog on 2026-09-02, and news reports describe active exploitation, possibly chained with companion zero-day CVE-2026-83548, with reverse shells and cryptocurrency miners observed; no public proof-of-concept is known. EPSS assigns an 8.5% probability of exploitation within 30 days (95th percentile).
    · SonicWall SMA1000 series appliances - Appliance Management Console (AMC) · SonicWall SMA 6210 (SMA1000 series firmware) KEVmoderate
  • CVE-2026-154107.212%
    Authenticated OS Command Injection in SonicWall SMA 1000 Appliance Management Console
    CVE-2026-15410 is a post-authentication code injection flaw (CWE-94) in the Appliance Management Console (AMC) of SonicWall SMA 1000 series appliances. It is triggered when a remote attacker with valid administrator credentials accesses the AMC under specific conditions, allowing arbitrary OS command execution on the appliance. Successful exploitation yields full command execution with the privileges of the appliance, enabling data theft, credential harvesting, lateral movement, and — per CISA — use in ransomware operations. Organizations running SMA 1000 appliances (SMA 6210, SMA 7210, SMA 8000v) are affected. The flaw is being actively exploited in the wild as a zero-day, reportedly alongside a companion SMA 1000 zero-day (CVE-2026-15409) with which it may form an attack chain; it was added to the CISA KEV catalog on 2026-07-14, and EPSS (11.8%, 96th percentile) indicates elevated near-term exploitation risk.
    · SonicWall SMA1000 Appliance Management Console (AMC) — SMA 6210 · SonicWall SMA1000 Appliance Management Console (AMC) — SMA 7210 KEV ransomwaremoderate

Appears with

organization SonicWall 2malware KNUCKLEBALL 2vendor SonicWall 2product SonicWall SMA 1000 1product KNUCKLEBALL 1organization Volexity 1product SMA 1000 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.