SonicWall Patches Two New Actively Exploited Zero
SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.
SonicWall released hotfixes for two zero-day vulnerabilities in its SMA 1000 VPN appliances, with SonicWall PSIRT confirming active exploitation in the wild. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface allowing unauthenticated unauthorized operations; CVE-2026-83549 (CVSS 7.8) is a post-authentication OS command injection in the Appliance Management Console enabling arbitrary command execution and RCE. The flaws affect models 6210, 7210 and 8200v running 12.4.3-03453 or earlier and 12.5.0-02835 or earlier, fixed in versions 12.4.3-03526 and 12.5.0-02952. This follows a July Volexity report on threat actor UTA0533 chaining two SMA 1000 zero-days to gain root access and deploy the KNUCKLEBALL Python backdoor.
- CVE-2026-83548: CVSS 10.0 pre-auth SSRF in Appliance Work Place interface enabling unauthenticated unauthorized operations.
- CVE-2026-83549: CVSS 7.8 post-auth OS command injection in Appliance Management Console enabling arbitrary command execution.
- SonicWall says attackers likely chain both flaws to achieve arbitrary code execution on vulnerable appliances.
- Affects models 6210, 7210, 8200v; fixed in 12.4.3-03526 and 12.5.0-02952; re-image and reset credentials if compromised.
- Second SMA incident in a month; Volexity's UTA0533 previously chained zero-days to deploy the KNUCKLEBALL backdoor.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1059 Command and Scripting Interpreter
- Vendors
- SonicWall
- Products
- SonicWall SMA 1000KNUCKLEBALL
- Threat actors
- UTA0533
- Malware
- KNUCKLEBALL
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-15409+1 related CVE | Unauthenticated SSRF in SonicWall SMA1000 Appliances | 10.0 group max | 7% | KEVRansomwarePoC | KEV |
CVE-2026-83548+1 related CVE | Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface | 10.0 group max | 8% | KEVPoC ×3 | KEV |
From the original article
2 min read at securityaffairs.com
SonicWall patched two zero-days in SMA 1000 VPNs, including a CVSS 10 pre-auth SSRF flaw, after confirming active exploitation. SonicWall has released security updates for two vulnerabilities in its SMA 1000 VPN appliances that are actively exploited in attacks in the wild. CVE-2026-83548 (CVSS 10.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.