Attackers exploit zero-days in consistently besieged SonicWall product
Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.
SonicWall disclosed and patched two zero-days in SMA 1000 appliances: CVE-2026-83548, a maximum-severity pre-authentication SSRF, and CVE-2026-83549, a high-severity OS command injection. Rapid7 said chaining the flaws yields unauthenticated remote code execution, and CISA added both to its KEV catalog Wednesday. The vendor provided no IOCs or victim counts, urging customers to hunt for compromise, reimage or redeploy appliances, and reset all passwords and tokens. The product has faced repeated exploitation, including ransomware-linked flaws used by INC and Akira.
- CVE-2026-83548 (pre-auth SSRF, max severity) and CVE-2026-83549 (OS command injection) chain to unauthenticated RCE
- Both actively exploited in the wild; CISA added them to the KEV catalog
- No IOCs published; vendor advises reimage/redeploy and full credential and token resets
- Fifth and sixth SonicWall SMA 1000 flaws added to KEV since mid-December 2025
- INC and Akira ransomware groups have historically targeted SonicWall devices
- Products
- SonicWall SMA 1000
- Threat actors
- INC RansomwareAkira
- Victims
- SonicWall customers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-83548+1 related CVE | Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface | 10.0 group max | 8% | KEVPoC ×3 | KEV |
From the original article
3 min read at cyberscoop.com
SonicWall customers have confronted a barrage of attacks for years, including five actively exploited vulnerabilities in SMA 1000 appliances since late 2025. The post Attackers exploit zero-days in consistently besieged SonicWall product appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.