Threat reportVulnerabilityTL-2026-2307
SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548, CVE-2026-83549) Exploited in the Wild
SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548 (TL-2026-2307) is a critical-severity software vulnerability scored CVSS 10, first published 2026-09-03. It has no confirmed attribution, affects SonicWall SMA1000 Secure Mobile Access (models 6210, 7210, 8200v), references 2 CVEs (CVE-2026-83548, CVE-2026-83549), maps to 8 MITRE ATT&CK techniques (T1005, T1059, T1078), and is covered by 9 detection rules and 15 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-2307
- Threat ID
- TL-2026-2307
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, enterprise, critical infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
How SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548 works
A pre-authentication SSRF in the SonicWall SMA1000 Appliance Work Place interface (CVE-2026-83548, CVSS 10.0) can be chained with a post-authentication OS command injection in the Appliance Management Console (CVE-2026-83549, CVSS 7.8) to achieve unauthenticated remote code execution on internet-facing SSL-VPN gateways. SonicWall confirmed active exploitation on September 1, 2026, and CISA added both CVEs to the Known Exploited Vulnerabilities catalog the following day with a September 5, 2026 remediation deadline.
On September 1, 2026, SonicWall PSIRT published advisory SNWLID-2026-0016 disclosing two vulnerabilities affecting the SMA1000 series of Secure Mobile Access SSL-VPN appliances (hardware models 6210 and 7210, and the 8200v virtual appliance). CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF, CWE-918/CWE-441 'confused deputy') in the Appliance Work Place interface, arising from an unintended alternate access path that lets a remote, unauthenticated attacker reach internal appliance functionality that should be restricted. CVE-2026-83549 is a post-authentication OS command injection (CWE-78) in the Appliance Management Console (AMC) that, on its own, requires administrator credentials to run arbitrary operating-system commands. Multiple outlets (Rapid7, BleepingComputer) report that the two flaws are being chained: the unauthenticated SSRF is used to reach the AMC's command-injection surface, letting an attacker execute arbitrary OS commands and achieve remote code execution without any prior authentication. SonicWall's own researchers, William Perry and Adam Babis, are credited with the discovery, and the vendor confirmed active exploitation in the wild at time of disclosure.
CISA added both CVEs to the Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026, with a September 5, 2026 remediation deadline for federal civilian agencies under Binding Operational Directive 26-04. As of publication, no public proof-of-concept, detailed post-exploitation chain, or indicators of compromise have been released by SonicWall, Rapid7, or Sophos; all three explicitly note the absence of published IOCs and attribution. Truesec's detection guidance is the most concrete technical signal available: reviewing appliance logs for POST requests to the /workplace/ endpoint containing URL-encoded internal or loopback addresses (e.g. 127.0.0.1), and for AMC access originating from the appliance's own internal workplace process rather than an approved administrator management station, both indicative of the SSRF-to-AMC chain in action.
The affected models are patched in 12.4.3-03526 platform-hotfix and 12.5.0-02952 platform-hotfix (and later). SMA 100 series appliances and SSL-VPN on SonicWall firewalls are explicitly NOT affected. SonicWall's standard post-compromise guidance is unusually aggressive for an appliance vendor: re-image hardware or redeploy virtual instances from a known-good image, reset all user and administrator passwords, and reinitialize TOTP/MFA seed tokens — mirroring the remediation SonicWall issued after the immediately preceding SMA1000 zero-day pair (CVE-2026-15409/CVE-2026-15410, disclosed July 14, 2026), where Rapid7 documented attackers systematically extracting credentials, session databases, and TOTP seed configurations from compromised appliances after pre-disclosure exploitation traced back to June 22, 2026 by threat actor UTA0533. This is the third SMA1000 zero-day event in roughly 14 months (following a suspected zero-day OS command injection flaw patched around January 2025, CVE-2025-40602 in December 2025, and the July 2026 CVE-2026-15409/15410 pair that CISA later confirmed was exploited by ransomware-affiliated actors), reinforcing NHS England National CSOC's assessment that further exploitation of internet-facing SSL-VPN gateways in this product line is 'almost certain.'
MITRE ATT&CK techniques used in TL-2026-2307
Collection
Execution
T1059 Command and Scripting Interpreter
Persistence
Credential Access
T1111 Multi-Factor Authentication Interception; T1555 Credentials from Password Stores
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
Reconnaissance
Affected products and versions in SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548
- SonicWall — SMA1000 Secure Mobile Access (models 6210, 7210, 8200v)
Vulnerable versions: 12.4.3-03453 platform-hotfix and earlier; 12.5.0-02835 platform-hotfix and earlier
Fixed in: 12.4.3-03526 platform-hotfix and later; 12.5.0-02952 platform-hotfix and later
Remediation for SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548
Patches
- 12.4.3-03526 platform-hotfix and later (12.4.3 branch)
- 12.5.0-02952 platform-hotfix and later (12.5.0 branch)
- Hotfixes available via mysonicwall.com
Immediate actions
- Apply the SonicWall hotfix (12.4.3-03526 or 12.5.0-02952 and later) to every internet-facing SMA1000 appliance immediately
- Restrict network access to the Appliance Work Place and Appliance Management Console interfaces to trusted administrative networks until patched
- Review appliance logs for POST requests to /workplace/ containing URL-encoded internal or loopback addresses (e.g. 127.0.0.1), and for AMC access originating from the appliance's own workplace process rather than an approved administrator workstation
- Contact SonicWall Technical Support to review the appliance for indicators of compromise per vendor guidance
Workarounds
- Restrict Appliance Work Place interface exposure to trusted administrative networks only
- Limit Appliance Management Console (AMC) access to trusted management IP ranges
- Monitor outbound/internal connections from SMA1000 appliances for anomalous SSRF-indicative traffic patterns
Longer-term hardening
- If compromise is confirmed or suspected, re-image hardware appliances or redeploy virtual SMA1000 instances from a known-good image rather than trusting an in-place patch
- Reset all user and administrator passwords and reinitialize TOTP/MFA seed tokens on affected appliances
- Segment and separately monitor SSL-VPN gateway management interfaces (Work Place, AMC) from general remote-access traffic
- Track this appliance family for its recurring zero-day pattern (CVE-2025-40602, CVE-2026-15409/15410, CVE-2026-83548/83549) and prioritize an accelerated patch cadence for SMA1000
CVEs associated with SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548
Weaknesses (CWE) in SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548
Timeline of SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548
- Approximate date (per The Register's historical review): an earlier suspected zero-day OS command injection flaw in the SMA1000 line was patched, the first in the recent recurring pattern of SMA1000 zero-days.
- Approximate date (per The Register): CISA confirmed ransomware-affiliated actors had exploited an earlier SMA1000 zero-day, foreshadowing the product line's attractiveness to financially motivated intrusion actors.
- Approximate date (per BleepingComputer's historical context): a state-sponsored breach was linked to SonicWall SMA appliance compromise.
- Approximate date (per BleepingComputer): SonicWall issued a zero-day warning for CVE-2025-40602 affecting the SMA product line.
- Volexity traced pre-disclosure zero-day exploitation of the (separate) SMA1000 vulnerability pair CVE-2026-15409/CVE-2026-15410 back to this date, attributed to threat actor UTA0533.
- SonicWall publicly disclosed CVE-2026-15409 (CVSS 10.0 pre-auth SSRF in the Workplace interface) and CVE-2026-15410, the immediately preceding SMA1000 zero-day pair chained for admin access.
- Rapid7 published an Exploit Timeline Report documenting attackers chaining CVE-2026-15409/15410 to extract credentials, active session databases, and TOTP MFA seed configurations from compromised SMA1000 appliances.
- Approximate date (per BleepingComputer): CISA confirmed ransomware-affiliated exploitation tied to the July 2026 SMA1000 vulnerabilities (CVE-2026-15409/15410).
- SonicWall researchers William Perry and Adam Babis discovered and the vendor disclosed CVE-2026-83548 (pre-auth SSRF, CVSS 10.0) and CVE-2026-83549 (post-auth OS command injection, CVSS 7.8) via advisory SNWLID-2026-0016, confirming active exploitation in the wild at time of disclosure.
- The Shadowserver Foundation reported tracking approximately 400 internet-exposed SonicWall SMA1000 appliances, per BleepingComputer's coverage of the active exploitation.
- Sophos (SophosLabs) published a technical analysis and stated it is monitoring for exploitation activity, with detections planned as available.
- Rapid7 published an Exploit Timeline Report on the chained SSRF-to-command-injection exploitation and announced forthcoming detection content for InsightVM, Nexpose, and Exposure Command.
- CISA added both CVE-2026-83548 and CVE-2026-83549 to the Known Exploited Vulnerabilities catalog, setting a September 5, 2026 remediation deadline for federal civilian agencies under BOD 26-04.
- Truesec, BleepingComputer, SecurityWeek, Help Net Security, The Register, The Hacker News, and other outlets published independent technical write-ups on the chained vulnerabilities, coinciding with CISA's broader KEV update naming seven newly exploited flaws across multiple vendors.
Sources cited for SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548
- SonicWall vulnerabilities exploited in the wild
- SNWLID-2026-0016 Security Advisory
- NVD - CVE-2026-83548
- NVD - CVE-2026-83549
- CISA Known Exploited Vulnerabilities Catalog
- ETR: Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
- SonicWall SMA1000 vulnerabilities (CVE-2026-83548, CVE-2026-83549)
- SonicWall warns of actively exploited SMA1000 zero-day flaws
- SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks
- SonicWall SMA 1000 appliances under attack via zero-day flaws
- SonicWall's SMA1000 boxes under active attack again
- CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells
- CISA Warns of SonicWall SMA1000 Vulnerabilities Actively Exploited
- SonicWall Warns Of Two Actively Exploited SMA1000 Zero-Days
- SonicWall advises customers to patch two new SMA1000 zero-days
Detection coverage for TL-2026-2307
As of 2026-09-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2307 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.