SonicWall's SMA1000 boxes under active attack again
SonicWall warns attackers are chaining two SMA1000 zero-days, a CVSS 10.0 SSRF and command injection, to compromise VPN gateways.
SonicWall says attackers are actively exploiting two chained zero-days in SMA 1000 appliances: CVE-2026-83548, a pre-authentication SSRF rated CVSS 10.0, and CVE-2026-83549, a post-authentication OS command injection (CVSS 7.8) in the Appliance Management Console. Hotfixes are available for SMA 6210, 7210, and 8200v appliances with no workarounds; SonicWall recommends reimaging compromised devices, rotating passwords, and resetting TOTP tokens. NHS England assesses further exploitation as almost certain, following a similar exploited pair in July when CISA added CVE-2026-15409 to its KEV catalog.
- CVE-2026-83548: pre-auth SSRF, CVSS 10.0, from an unintended alternative access path
- CVE-2026-83549: post-auth OS command injection in SMA1000 AMC, CVSS 7.8
- SMA 6210, 7210, 8200v affected; hotfixes released, no workarounds available
- NHS England CSOC assesses future exploitation of the flaws as almost certain
- Follows July's similar SSRF-plus-command-injection pair used in ransomware campaigns
- Vendors
- SonicWall
- Products
- SMA 1000
- Victims
- NHS England
- Organizations
- NHS EnglandCISA
- Countries
- United Kingdom
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-15409 | Unauthenticated SSRF in SonicWall SMA1000 Appliances | 10.0 | 7% | KEVRansomwarePoC | KEV |
CVE-2026-83548+1 related CVE | Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface | 10.0 group max | 8% | KEVPoC ×3 | KEV |
From the original article
2 min read at theregister.comMiscreants use chained zero days to pwn boxen as third-party SOCs say further attacks 'almost certain'
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.