Hackers Chain Two New SonicWall Zero-Day Vulnerabilities
SonicWall warns two zero-days (CVE-2026-83548 SSRF, CVE-2026-83549 post-auth RCE) in SMA1000 appliances are being actively exploited.
A September 1 SonicWall advisory discloses actively exploited zero-days in SMA1000 appliance models 6210, 7210 and 8200v, affecting platform-hotfix versions 12.4.3-03453 and 12.5.0-02835 and older. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface via an unintended alternate access path; CVE-2026-83549 (CVSS 7.8) is post-authentication OS command injection enabling RCE in the Appliance Management Console. SonicWall urges hotfix upgrades, IOC checks with SonicWall support, and re-imaging plus credential and TOTP resets if compromise is found.
- Pre-auth SSRF allows unauthenticated unauthorized access to sensitive functionality
- Post-auth RCE requires administrator-level authentication but yields arbitrary OS command execution
- SMA1000 edge appliances are frequent targets of state-sponsored and ransomware actors
- Guidance: upgrade hotfixes, hunt IOCs, re-image/redeploy, change all passwords, reset TOTP tokens
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-83548+1 related CVE | Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface | 10.0 group max | 8% | KEVPoC ×3 | KEV |
From the original article
1 min read at infosecurity-magazine.com
SonicWall has urged customers to patch two new zero-day vulnerabilities being exploited in the wild
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.