Cybercriminals chain two SonicWall vulnerabilities to break into remote-access appliances. SonicWall disclosed two vulnerabilities in its SMA1000 remote-access appliances on 1 September, and cybercriminals are already exploiting both. CVE-2026-83548 scores a maximum 10.0 out of 10 (Critical) CVSS score and CVE-2026-83549 scores 7.8 (High). Chained together, they let a cybercriminal with no username or password run commands on the appliance. What are these vulnerabilities? An SMA1000 is the gateway staff log in to when they work remotely. It sits at the edge of the network and faces the internet by design. CVE-2026-83548 is a Server-Side Request Forgery (SSRF), a vulnerability that tricks a server into making network requests on an outsider's behalf. SonicWall describes an unintended alternate access path in its Work Place portal, the page employees use to sign in. That path turns the appliance into an unintended forward proxy, relaying an outsider's requests to internal systems that should be out of reach. No login is needed. CVE-2026-83549 sits in SonicWall's Appliance Management Console, the administrator control panel. It is a command injection vulnerability whereby the appliance treats part of a cybercriminal's input as an instruction to its operating system, not as plain data. On its own, it needs an administrator account, but the chain removes that obstacle. The first vulnerability carries the attacker to the management console, and the second one runs the commands. Why this is dangerous A cybercriminal that completes the chain controls the appliance. From there they can: * Read and alter traffic passing through the virtual private network (VPN). * Collect employee credentials as they arrive. * Use the device to reach deeper into the corporate network. Remote-access gateways are a well-known ransomware entry point, because they hold access to everything behind them. SonicWall confirmed cybercriminals exploited both vulnerabilities as zero-days, so attacks began before a patch existed. CISA added the pair to its KEV Catalog on 2 September and US federal agencies had until 5 September to fix them - far shorter than the usual three weeks. SonicWall has not named the group behind the attacks or released indicators of compromise. The Shadowserver Foundation counts more than 400 SMA1000 appliances reachable online. Affected software The vulnerabilities affect SMA1000 models 6210, 7210 and 8200v running platform-hotfix firmware 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier. SonicWall states that SMA 100 series appliances and the SSL-VPN feature on SonicWall firewalls are not affected. Mitigation and next steps Upgrade to 12.4.3-03526 or 12.5.0-02952 or later. SonicWall offers no workaround, so patching is the only fix. Organizations that suspect a breach should re-image the appliance (or re-deploy it if virtual), then reset every user and administrator password along with all time-based one-time password (TOTP) tokens. Need help? If you have any questions, don't hesitate to reach out.

Critical SonicWall remote code execution vulnerabilities actively exploited in attacks. Spread the love SonicWall has warned that attackers are actively exploiting two critical vulnerabilities affecting SMA1000 Series secure mobile access appliances. The flaws could allow unauthenticated attackers to access sensitive functionality and enable administrators with authenticated access to execute arbitrary operating system commands. The company published advisory SNWLID-2026-0016 on September 1, 2026, confirming that its Product Security Incident Response Team investigated a case indicating active exploitation. SonicWall urged organizations to install the available platform hotfixes immediately and review exposed systems for signs of compromise. The vulnerabilities affect SMA1000 6210, 7210, and 8200v appliances running version 12.4.3-03453 or earlier, as well as version 12.5.0-02835 or earlier. SonicWall stated that SSL-VPN services running on SonicWall firewalls and the SMA 100 Series product line are not affected. SonicWall RCE vulnerabilities exploited. The most severe issue is tracked as CVE-2026-83548 and carries a CVSS score of 10.0. It is a pre-authentication server-side request forgery vulnerability in the SMA1000 Appliance Workplace interface. According to SonicWall, the flaw stems from an unintended alternate access path that can serve as a forward proxy. A remote, unauthenticated attacker could exploit this path to access sensitive internal functionality and perform unauthorized operations. The vulnerability is associated with CWE-918, covering server-side request forgery, and CWE-441, which describes an unintended proxy or confused-deputy condition. SSRF vulnerabilities are especially dangerous in remote-access appliances because they can allow attackers to make requests from the device itself, potentially bypassing network restrictions designed to protect internal services. SonicWall also addressed CVE-2026-83549, a post-authentication remote code execution flaw in the SMA1000 Appliance Management Console. The vulnerability has a CVSS score of 7.8 and stems from improper neutralization of special characters in operating system commands. An authenticated attacker with administrator privileges could exploit the command injection issue to execute arbitrary commands on the appliance operating system. While this vulnerability requires valid administrator access, it could be especially damaging when chained with another weakness that provides unauthorized access to appliance functions. Remote-access infrastructure remains a high-value target because it often sits at the edge of enterprise networks and handles user authentication, VPN connectivity, and access to internal resources. A compromised SMA appliance may provide attackers with a foothold for credential theft, lateral movement, and further network intrusion. There is no workaround for either issue. Organizations should upgrade SMA1000 appliances to version 12.4.3-03526 or later, or to version 12.5.0-02952 or later, depending on the software branch they have deployed. SonicWall also recommends contacting technical support to review appliances for indicators of compromise. If compromise indicators are found, organizations should re-image affected physical appliances or redeploy affected virtual appliances. Administrators should then change all user and administrator passwords and reset TOTP tokens to invalidate potentially stolen authentication factors. Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC The post critical SonicWall remote code execution vulnerabilities actively exploited in attacks appeared first on Cyber Security News. July 15, 2026 SonicWall has issued an urgent security advisory regarding two vulnerabilities affecting its SMA1000 Series appliances. The company is warning that attackers are actively exploiting these flaws in real-world attacks. The most critical issue, tracked as CVE-2026-15409, carries a maximum CVSS severity score of 10.0 and can be... July 15, 2026 In "Cybersecurity News - Original News Source is cybersecuritynews.com" Security researchers have discovered a critical privilege escalation vulnerability in SonicWall's SMA1000 appliance that attackers are actively exploiting to gain unauthorized administrative access. The vulnerability, tracked as CVE-2025-40602, affects the appliance management console and poses a significant risk to enterprise networks relying on SonicWall's remote access solutions. SonicWall PSIRT disclosed... December 18, 2025 In "Cybersecurity News - Original News Source is cybersecuritynews.com" The Australian Cyber Security Centre (ACSC) has issued a critical alert regarding a severe access control vulnerability in SonicWall products that is being actively exploited in attacks. The flaw, tracked as CVE-2024-40766, affects multiple generations of SonicWall firewalls and carries a critical CVSS score of 9.3, highlighting the significant risk... September 11, 2025 In "Cybersecurity News - Original News Source is cybersecuritynews.com"

SonicWall patches its second SMA zero-day pair. Anil Kale covers data protection, vulnerabilities and the business of security for... Media Partner SonicWall has patched a chained pair of SMA 1000 zero-day vulnerabilities under active exploitation, the second such pair the vendor has fixed in this product line in under two months. For security leaders who run edge remote-access gateways, the recurrence matters more than the individual bug: the same appliance shipped the same class of flaw twice, and attackers found the second pair before defenders had fully absorbed the first. The vulnerability chain. SonicWall's Product Security Incident Response Team disclosed two vulnerabilities in its SMA 1000 series Secure Mobile Access appliances, used by mid-size and large enterprises, government agencies and managed security providers to broker remote employee access to internal networks. CVE-2026-83548 is a pre-authentication server-side request forgery flaw in the appliance's Work Place interface, rated a maximum CVSS score of 10.0. It lets a remote, unauthenticated attacker force the appliance into acting as an unintended forward proxy, reaching internal functionality it was never meant to expose. CVE-2026-83549 is a lower-severity, post-authentication operating system command injection flaw in the Appliance Management Console, rated 7.8, that lets an authenticated administrator-level session execute arbitrary commands. Media Partner Why the pairing matters. Neither bug alone is unusual for an internet-facing appliance. Chained together, they are a different problem: the unauthenticated SSRF flaw can be used to reach the management console that the command-injection flaw then turns into code execution, giving an attacker with no credentials at all a path to remote code execution on the device. SonicWall said it had investigated a case indicating active exploitation of the vulnerabilities, which is the vendor's standard language for confirming attacks are already underway rather than merely theoretical. The Work Place interface is the SMA1000's user-facing web portal, the same component remote employees use to authenticate and launch their session, which is why an unauthenticated flaw there is treated as maximum severity rather than a lesser access-control gap. The affected hardware is limited to the SMA1000 6210, 7210 and 8200v models. SonicWall said the flaws do not affect SSL-VPN running on its firewalls or the separate SMA 100 series product line, a distinction worth checking carefully given how similarly the two SMA product families are named and how differently they need to be patched. Fixes are available in hotfix releases 12.4.3-03526, 12.5.0-02952 and later, and SonicWall's advisory frames the update as urgent rather than routine given the confirmed exploitation. A pattern, not an isolated incident. This is not SonicWall's first SMA1000 zero-day pair this year. In July, the vendor disclosed and patched CVE-2026-15409 and CVE-2026-15410, a pre-authentication SSRF flaw in the same Appliance Work Place interface, also rated CVSS 10.0, chained with a post-authentication command-injection flaw in the same Appliance Management Console, both also confirmed under active exploitation before a patch existed. The bug class, the interface, the console and the severity profile are effectively identical across both incidents, seven weeks apart. That repetition is the story for a security desk covering the vendor ecosystem, not just the product. Remote-access gateways sit at the network edge by design, authenticate users before anything else does, and are exposed to the internet as a matter of function rather than misconfiguration. When the same appliance ships the same shape of bug twice in two months, it says less about one bad patch and more about how much attacker attention edge access infrastructure is now getting, and how thin the margin is between disclosure and exploitation on that class of device, a gap CyberTech has tracked closely as a maximum CVSS score alone has stopped telling defenders what to patch first. Get the week's best tech coverage. Free. Read by thousands of HR, tech, and business leaders. What this means for the security leader. Patch management processes built around annual or quarterly appliance update cycles are not matched to this threat model. SMA1000 owners need hotfix 12.4.3-03526 or 12.5.0-02952 (or later) applied now, not queued behind a change-control window, given SonicWall's own confirmation of active exploitation. Because the appliance's job is authenticating remote access, a compromise here does not stay contained to the device: it hands an attacker a foothold inside the perimeter that VPN and zero-trust access gateways exist to protect. Security teams that patched the July SMA1000 pair should not treat that as evidence the product line is now hardened, in the same way unauthenticated-access flaws in ServiceNow earlier this year showed that one round of patching rarely closes an entire bug class. The two incidents share an interface and a console, which is a reasonable prompt to ask SonicWall, directly or through account teams, what structural changes are being made to the Appliance Work Place and Appliance Management Console codebases rather than patching each SSRF and command-injection pair as it surfaces. Enterprises with SMA1000 deployments should also confirm exposure by checking which of the three affected models, 6210, 7210 or 8200v, they run, since SonicWall was specific that the separate SMA 100 line and firewall SSL-VPN are unaffected. What to do now. Apply hotfix 12.4.3-03526, 12.5.0-02952 or later immediately on any SMA1000 6210, 7210 or 8200v appliance. Review Appliance Management Console access logs for administrative sessions and configuration changes that do not match known change requests, since the command-injection half of the chain requires an authenticated session that may itself be the product of a prior compromise. Treat any SMA1000 appliance that has not yet received the hotfix as a live exposure rather than a pending maintenance item, consistent with SonicWall's confirmation that exploitation is already occurring in the wild. Inventory every internet-facing SMA1000 device the organization operates, including units managed on behalf of clients by managed security service providers, since the appliance's role brokering third-party remote access means a single unpatched box can expose more than one organization's network at once. Anil Kale. Anil Kale covers data protection, vulnerabilities and the business of security for CyberTech Edition. Media Partner