# SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548, CVE-2026-83549) Exploited in the Wild

> A pre-authentication SSRF in the SonicWall SMA1000 Appliance Work Place interface (CVE-2026-83548, CVSS 10.0) can be chained with a post-authentication OS command injection in the Appliance Management Console (CVE-2026-83549, CVSS 7.8) to achieve unauthenticated remote code execution on internet-facing SSL-VPN gateways. SonicWall confirmed active exploitation on September 1, 2026, and CISA added both CVEs to the Known Exploited Vulnerabilities catalog the following day with a September 5, 2026 remediation deadline.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2307
- **ID:** TL-2026-2307
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-83548, CVE-2026-83549

## Description

On September 1, 2026, SonicWall PSIRT published advisory SNWLID-2026-0016 disclosing two vulnerabilities affecting the SMA1000 series of Secure Mobile Access SSL-VPN appliances (hardware models 6210 and 7210, and the 8200v virtual appliance). CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF, CWE-918/CWE-441 'confused deputy') in the Appliance Work Place interface, arising from an unintended alternate access path that lets a remote, unauthenticated attacker reach internal appliance functionality that should be restricted. CVE-2026-83549 is a post-authentication OS command injection (CWE-78) in the Appliance Management Console (AMC) that, on its own, requires administrator credentials to run arbitrary operating-system commands. Multiple outlets (Rapid7, BleepingComputer) report that the two flaws are being chained: the unauthenticated SSRF is used to reach the AMC's command-injection surface, letting an attacker execute arbitrary OS commands and achieve remote code execution without any prior authentication. SonicWall's own researchers, William Perry and Adam Babis, are credited with the discovery, and the vendor confirmed active exploitation in the wild at time of disclosure.

CISA added both CVEs to the Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026, with a September 5, 2026 remediation deadline for federal civilian agencies under Binding Operational Directive 26-04. As of publication, no public proof-of-concept, detailed post-exploitation chain, or indicators of compromise have been released by SonicWall, Rapid7, or Sophos; all three explicitly note the absence of published IOCs and attribution. Truesec's detection guidance is the most concrete technical signal available: reviewing appliance logs for POST requests to the /workplace/ endpoint containing URL-encoded internal or loopback addresses (e.g. 127.0.0.1), and for AMC access originating from the appliance's own internal workplace process rather than an approved administrator management station, both indicative of the SSRF-to-AMC chain in action.

The affected models are patched in 12.4.3-03526 platform-hotfix and 12.5.0-02952 platform-hotfix (and later). SMA 100 series appliances and SSL-VPN on SonicWall firewalls are explicitly NOT affected. SonicWall's standard post-compromise guidance is unusually aggressive for an appliance vendor: re-image hardware or redeploy virtual instances from a known-good image, reset all user and administrator passwords, and reinitialize TOTP/MFA seed tokens — mirroring the remediation SonicWall issued after the immediately preceding SMA1000 zero-day pair (CVE-2026-15409/CVE-2026-15410, disclosed July 14, 2026), where Rapid7 documented attackers systematically extracting credentials, session databases, and TOTP seed configurations from compromised appliances after pre-disclosure exploitation traced back to June 22, 2026 by threat actor UTA0533. This is the third SMA1000 zero-day event in roughly 14 months (following a suspected zero-day OS command injection flaw patched around January 2025, CVE-2025-40602 in December 2025, and the July 2026 CVE-2026-15409/15410 pair that CISA later confirmed was exploited by ransomware-affiliated actors), reinforcing NHS England National CSOC's assessment that further exploitation of internet-facing SSL-VPN gateways in this product line is 'almost certain.'

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1555 Credentials from Password Stores
- T1111 Multi-Factor Authentication Interception
- T1005 Data from Local System

## Sources

- [SonicWall vulnerabilities exploited in the wild](https://www.truesec.com/hub/blog/sonicwall-vulnerabilities-exploited-in-the-wild)
- [SNWLID-2026-0016 Security Advisory](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016)
- [NVD - CVE-2026-83548](https://nvd.nist.gov/vuln/detail/CVE-2026-83548)
- [NVD - CVE-2026-83549](https://nvd.nist.gov/vuln/detail/CVE-2026-83549)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [ETR: Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild](https://www.rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild/)
- [SonicWall SMA1000 vulnerabilities (CVE-2026-83548, CVE-2026-83549)](https://www.sophos.com/en-us/blog/sonicwall-83548-83549)
- [SonicWall warns of actively exploited SMA1000 zero-day flaws](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/)
- [SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks](https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/)
- [SonicWall SMA 1000 appliances under attack via zero-day flaws](https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/)
- [SonicWall's SMA1000 boxes under active attack again](https://www.theregister.com/security/2026/09/02/sonicwalls-sma1000-boxes-under-active-attack-again/5293969)
- [CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells](https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html)
- [CISA Warns of SonicWall SMA1000 Vulnerabilities Actively Exploited](https://cybersecuritynews.com/sonicwall-vulnerabilities-actively-exploited/)
- [SonicWall Warns Of Two Actively Exploited SMA1000 Zero-Days](https://thecyberexpress.com/sonicwall-warns-of-two-zero-days-in-sma1000/)
- [SonicWall advises customers to patch two new SMA1000 zero-days](https://www.scworld.com/news/sonicwall-advises-customers-to-patch-two-new-sma1000-zero-days)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2307