Attackers chain two SonicWall SMA1000 flaws into unauthenticated RCE

MedDevice Cyber Staff · 21 hrs ago · 3 min read · Via SonicWall advisory SNWLID-2026-0016

SonicWall is warning that attackers are chaining two flaws in its SMA1000 remote access appliances into unauthenticated remote code execution. The company disclosed both on September 1 in advisory SNWLID-2026-0016 after its product security team investigated an attack that combined them against a customer. Affected models are the SMA 6210, 7210, and the virtual 8200v.

CVE-2026-83548 is a pre-authentication server-side request forgery in the Appliance Work Place interface that allows command injection, base score 10.0. CVE-2026-83549 is an OS command injection in the Appliance Management Console, base score 7.8, and normally requires administrator credentials. Chained behind the first flaw, it needs none.

Fixes shipped as platform hotfixes 12.4.3-03526 and 12.5.0-02952. Builds at 12.4.3-03453 or 12.5.0-02835 and earlier are vulnerable. SSL-VPN on SonicWall firewalls and the SMA 100 series are not affected.

CISA added both CVEs to the Known Exploited Vulnerabilities catalog on September 3. Shadowserver counts roughly 400 SMA1000 appliances reachable from the internet, most of them in the United States, and some of those front remote access for health systems and their vendors. HIPAA Journal pushed the warning to the healthcare sector on September 4.

The SMA1000 line has been here before. Attackers exploited CVE-2026-15409 and CVE-2026-15410 in July 2026 to plant custom malware on the appliances, and a December 2025 chain built on CVE-2025-40602 reached root. For device manufacturers the box matters less as a product than as a path: these appliances commonly terminate the remote access that service engineers and suppliers use to reach production and clinical networks.

Three rounds of exploited zero days since December is a track record, and it belongs in the vendor risk file next to the CVSS scores. A patch applied after exposure does not evict anyone who arrived first, so budget for log review and credential rotation on every appliance that sat on the internet unpatched.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update SMA1000 appliances to platform hotfix 12.4.3-03526 or 12.5.0-02952, the builds SonicWall shipped with SNWLID-2026-0016. Both flaws were exploited before disclosure, so treat any internet-facing appliance that ran an earlier build as potentially compromised and investigate before returning it to service. The September 3 KEV listing puts a remediation clock on federal agencies and the contractors that mirror their timelines.

Apply the platform hotfix. Move SMA 6210, 7210, and 8200v appliances to 12.4.3-03526 or 12.5.0-02952 per SNWLID-2026-0016. Every earlier build is exposed.
Assume compromise and check. The chain ran in the wild before the patch existed. Review appliance logs, administrator accounts, and outbound connections before putting the appliance back in service.
Rotate what the appliance touched. Credentials, certificates, and MFA seeds that terminated on the box are in scope once unauthenticated code execution is on the table.
Keep management planes off the internet. Restrict the Work Place and Management Console interfaces to trusted management networks. That single control would have removed most of the roughly 400 exposed appliances from the target pool.

For Device ManufacturersFix the class in the product

Device makers close this class at the source, not on the ward. The full engineering remediation, down to code, firmware, and hardware changes, sits in the sponsor library.

Questions & Answers

What is CVE-2026-83548 in SonicWall SMA1000 appliances?

CVE-2026-83548 is a pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface, base score 10.0. Chained with CVE-2026-83549, an OS command injection in the Appliance Management Console, it gives an attacker unauthenticated remote code execution on SMA 6210, 7210, and 8200v appliances, and SonicWall confirmed active exploitation.

Is there a patch for the SonicWall SMA1000 vulnerabilities exploited in September 2026?

Yes. SonicWall shipped platform hotfixes 12.4.3-03526 and 12.5.0-02952 in advisory SNWLID-2026-0016. Builds 12.4.3-03453 and 12.5.0-02835 and earlier are vulnerable, and appliances that ran them while internet facing should be investigated for compromise.

Which SonicWall products are affected by CVE-2026-83548 and CVE-2026-83549?

Only the SMA1000 series models 6210, 7210, and the virtual 8200v. SSL-VPN on SonicWall firewalls and the SMA 100 series are not affected.

← Back to Threat Intel