Critical SonicWall SMA 1000 Zero-Day Vulnerabilities (CVE-2026-83548 & CVE-2026-83549)

Published: Thu 03 September 2026

Prepared by: Adam Skupien, Vulnerability Security Analyst

Purpose

SonicWall has disclosed two new vulnerabilities affecting SMA 1000 Series secure remote access appliances -CVE-2026-83548 (Server-Side Request Forgery, CVSSv3.1 10.0) and CVE-2026-83549 (OS Command Injection, CVSSv3.1 7.8) - which SonicWall has confirmed were actively exploited in the wild and which may be chained by an attacker to achieve remote code execution.

This is the second SMA 1000 zero-day chain in as many months (see Triskele Labs' prior bulletin on CVE-2026-15409 and CVE-2026-15410). Organisations that already patched and investigated for compromise following that earlier incident must treat this as a separate incident and a separate investigation window - that remediation does not cover this new exploit chain.

SonicWall discovered this exploitation internally and disclosed it on 2 September 2026 (SNWLID-2026-0016). As of this writing, SonicWall has not published indicators of compromise, exploitation timelines, or detailed technical root-cause information - this bulletin will be updated as more detail becomes available.

Vulnerability details

CVE-2026-83548 - Server-Side Request Forgery (SSRF)

• Severity: Critical (CVSSv3.1 10.0).
• Exploit status: Confirmed actively exploited in the wild (vendor-confirmed, discovered internally by SonicWall).
• Vulnerability type: Pre-authentication SSRF in the SMA1000 Appliance WorkPlace interface, described by SonicWall as an unintended alternate access path that allows the appliance to act as a forward proxy (CWE-918 / CWE-441).
• Exploitation requirements: No authentication or user interaction required. Public reporting indicates the flaw involves the /wsproxy WebSocket-proxy endpoint, reachable by spoofing client identifiers (User-Agent and URI parameters) to tunnel traffic to internal-only services.
• Impact of this stage alone: Unauthorised access to sensitive appliance functionality and the ability to reach services normally restricted to localhost, including the Appliance Management Console.

CVE-2026-83549 - OS Command Injection

• Severity: High (CVSSv3.1 7.8).
• Vulnerability type: OS command injection in the SMA1000 Appliance Management Console (AMC).
• Exploitation requirements: Post-authentication - requires administrator-level access to the AMC. Under specific conditions this allows a remote, authenticated administrator to execute arbitrary OS commands.
• Chained impact: Security researchers have not ruled out that the pre-authentication SSRF in CVE-2026-83548 could be used to reach the AMC and satisfy the authentication precondition for CVE-2026-83549. SonicWall has not confirmed whether this is the chain actually used in the observed attacks, and no public technical write-up has yet detailed it.

Exposure condition: Applies to internet-facing SMA1000 Appliance WorkPlace interfaces - the standard, intended deployment model for these devices.

Affected & fixed systems

Note: These vulnerabilities do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line. There is no mitigating configuration - upgrading to the fixed platform-hotfix is the only remediation.

The latest platform-hotfix is available for download on mysonicwall.com.

Impact

Successful exploitation of this chain could give a remote attacker, beginning with no authentication, a path to command execution on an internet-facing remote access gateway. Given the role SMA1000 appliances play brokering credentials, sessions, and MFA data for remote users, potential impact includes:

• Unauthorised access to internal-only appliance services and management functionality.
• Potential arbitrary OS command execution if the SSRF is used to reach the AMC.
• Downstream risk of credential harvesting, session/MFA token theft, and use of the appliance as a foothold into internal networks, though this has not yet been confirmed for this specific chain.

Over 400 internet-exposed SMA1000 appliances are currently visible to internet-wide scanning (Shadowserver), some proportion of which may already be patched.

Mitigation actions

Patch immediately - there is no workaround. SonicWall's advisory confirms active exploitation and states that all organisations with SMA1000 deployments (virtual or physical) on affected versions must:

• Upgrade to the latest platform-hotfix - 12.4.3-03526 or 12.5.0-02952 (or later) - available via mysonicwall.com.
• Contact SonicWall Technical Support for assistance reviewing the system for indicators of compromise (IOCs), since SonicWall has not published a public IOC list.
• Restrict administrator access to the AMC to trusted management networks only, reducing exposure to the post-authentication command injection component.

Detection capabilities

SonicWall has not published detailed IOCs, log signatures, or a confirmed exploitation timeline for this chain, and directs customers to its Technical Support team for IOC review on a case-by-case basis. Per SonicWall's guidance, if IOCs are detected on a system:

• Re-image (hardware) or re-deploy (virtual) the affected appliance - do not remediate in place.
• Change all user and administrator passwords associated with the appliance.
• Reset TOTP/MFA tokens for all users.

Pending further public technical detail, organisations may also wish to:

• Treat any internet-facing SMA1000 WorkPlace interface as a potential target, regardless of patch status prior to the hotfix.
• Review AMC access logs for administrator logins from unexpected source IPs or at unusual times, given the post-auth nature of CVE-2026-83549.
• Review appliance logs (/var/log/aventail/extraweb_access.log, /var/log/aventail/access_servers.log, /var/log/aventail/ctrl-service.log) as a starting point, watching in particular for anomalous /wsproxy-style requests.
• Monitor SonicWall's advisory (SNWLID-2026-0016) and independent security research for further updates.

MDR customers: Triskele Labs will develop and tune detections for behaviours consistent with the exploitation of CVE-2026-83548 and CVE-2026-83549 across supported log sources as further technical detail becomes available.

Vulnerability Management customers: Environments will be assessed for exposed and vulnerable SMA1000 appliance versions; any findings will be communicated through priority channels.

References

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016
• https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/
• https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/
• https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html
• https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/
• https://www.triskelelabs.com/resources/critical-sonicwall-sma-1000-zero-day-vulnerabilities-patch-and-investigate-for-compromise-cve-2026-15409-cve-2026-15410