SonicWall SMA1000 Two Zero-Days Exploited In the Wild: CVSS 10.0 SSRF Chained to Unauthenticated RCE
SonicWall confirmed SMA1000 zero-days CVE-2026-83548 and CVE-2026-83549 exploited in the wild. The former is CVSS 10.0; chained, they yield unauthenticated RCE. CISA added them to KEV.
SonicWall issued emergency advisory SNWLID-2026-0016 confirming two in-the-wild zero-days in the SMA1000 Secure Mobile Access gateway series: CVE-2026-83548, an unauthenticated SSRF at CVSS 10.0, and CVE-2026-83549, an OS command injection at CVSS 7.8. Chained, they yield unauthenticated remote code execution. CISA added the vulns to the Known Exploited Vulnerabilities (KEV) catalog and requires federal agencies to patch by September 5.
Incident Overview
SMA1000 (Secure Mobile Access 1000 series) is an enterprise secure remote-access gateway, widely deployed in large enterprises, government, and MSSPs as a VPN / zero-trust access device for internal apps. Affected models: 6210, 7210, and 8200v. In scope: 12.4.3-03453 (platform-hotfix) and earlier, 12.5.0-02835 (platform-hotfix) and earlier. SonicWall confirmed active exploitation in the wild.
Technical Details
CVE-2026-83548 is a pre-auth SSRF in the user-facing Work Place interface. Root cause: an unintended alternate access path. Unauthenticated remote attackers can reach sensitive functions and perform unauthorized operations. CVSS 10.0. CVE-2026-83549 is OS command injection in the Appliance Management Console (AMC); requires admin authentication. CVSS 7.8. Individually, one is low-bar and one is high-bar. Combined, SSRF bypasses the perimeter into internal admin functions, then hands off to command injection—full unauthenticated RCE against the VPN gateway itself.
Impact Assessment
VPN gateways sit on the outer edge. Full control means intercepting remote-access traffic, walking into the enterprise network, and moving laterally to core systems. SonicWall devices have repeatedly been a preferred ransomware entry point. Zero-day status, confirmed in-the-wild use, and a CISA deadline: treat as highest priority.
Remediation
- Upgrade immediately: 12.4.3-03526 (platform-hotfix) or later, 12.5.0-02952 (platform-hotfix) or later.
- Hunt IOCs per vendor guidance. If compromise is found, re-image the device and reset all related credentials.
- Temporary mitigation: restrict public exposure of the SMA1000 management interface and Work Place interface; allow trusted sources only.
- Detection: Qualys QID 388624 to identify affected assets. On the network, prioritize anomalous requests to the Work Place interface.
Sources
- SonicWall security advisory SNWLID-2026-0016
- Qualys ThreatPROTECT: CISA warns SMA1000 vulns exploited in the wild