SonicWall SMA 1000 appliances under attack via zero-day flaws
Attackers are exploiting two previously undisclosed vulnerabilities (CVE-2026-83548, CVE-2026-83549) in SonicWall SMA 1000 appliances, the vendor confirmed on Tuesday.
The vulnerabilities (CVE-2026-83548, CVE-2026-83549)
The SonicWall SMA 1000 series is a line of secure remote access appliances (SSL VPN gateways) built for scale. They are used regularly by medium to large enterprises, government agencies, and managed security service providers.
CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF) flaw in the Appliance Work Place interface, and allows remote unauthenticated attackers “to gain unauthorized access to sensitive functionality and perform unauthorized operations.”
CVE-2026-83549 is an OS command injection vulnerability in the Appliance Management Console that, in specific conditions, can be exploited by authenticated attackers with admin privileges to achieve remote code execution on unpatched appliances.
They affect both physical and virtual SMA 1000 models: 6210, 7210, and 8200v.
They don’t affect SMA 100 appliances or SonicWall firewalls.
William Perry and Adam Babis of SonicWall were credited with discovering the flaws.
What to do?
“SonicWall [Product Security Incident Response Team] has investigated a case indicating the active exploitation of the vulnerabilities,” SonicWall said, and “strongly urged” customers to implement the provided hotfix as soon as possible.
They have also been advised to contact SonicWall Technical Support for help in reviewing the system for indicators of compromise.
In case of a confirmed compromise, customers should re-image (hardware) or re-deploy (virtual) appliances, change all user and administrator passwords, and reset time-based one-time password (TOTP) tokens.
SonicWall SMA 1000: A recurring target
SonicWall hasn’t publicly shared a list of known indicators of compromise nor further details about the attacks.
SonicWall SMA 1000 appliances are often targeted by attackers via zero-day vulnerabilities, most recently (before these latest attacks) in June and July 2026 and late 2025.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
