Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
SonicWall patches two actively exploited zero-days (CVE-2026-83548, CVE-2026-83549) in SMA 1000 VPN appliances, likely chained for code execution.
SonicWall fixed CVE-2026-83548 (CVSS 10.0), a pre-authentication SSRF in the Appliance Work Place interface, and CVE-2026-83549 (CVSS 7.8), a post-authentication OS command injection in the Appliance Management Console. The company investigated a case indicating active exploitation, suggesting attackers chained both bugs to execute arbitrary code on susceptible devices. Affected SMA 1000 models 6210, 7210, and 8200v require hotfixes 12.4.3-03526 or 12.5.0-02952; customers are urged to hunt for IoCs and re-image, reset credentials, and rotate TOTP if found.
- CVE-2026-83548 (CVSS 10.0): pre-auth SSRF enabling unauthorized access to sensitive functionality.
- CVE-2026-83549 (CVSS 7.8): authenticated admin command injection leading to remote code execution.
- SonicWall confirmed active exploitation, possibly chaining both flaws; threat actor still unidentified.
- Fixes shipped in 12.4.3-03526 and 12.5.0-02952 platform hotfixes.
- Follows August fixes for CVE-2026-15409/15410 abused by UTA0533 to deploy KNUCKLEBALL malware.
- Vendors
- SonicWall
- Products
- SMA 1000
- Threat actors
- UTA0533
- Malware
- KNUCKLEBALL
- Organizations
- SonicWall
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-15409+1 related CVE | Unauthenticated SSRF in SonicWall SMA1000 Appliances | 10.0 group max | 7% | KEVRansomwarePoC | KEV |
CVE-2026-83548+1 related CVE | Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface | 10.0 group max | 8% | KEVPoC ×3 | KEV |
From the original article
1 min read at thehackernews.com
SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances that have been exploited in zero-day attacks. The vulnerabilities, discovered internally by SonicWall's William Perry and Adam Babis, are listed below - CVE-2026-83548 (CVSS score: 10. 0) - A pre-authentication SSRF vulnerability in the Appliance
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.