InfoSecBulletin Cybersecurity for mankind
SonicWall unveiled advisory SNWLID-2026-0016 on September 1, 2026. It states that two SMA1000 flaws are being actively exploited. The main issue, CVE-2026-83548, is a pre-authentication SSRF with a top score of 10.0 CVSS. The second issue, CVE-2026-83549, allows remote code execution after authentication.
Why It Matters
SMA1000 devices act as VPN gateways for businesses. Because of this, a security weakness lets remote attackers access them easily. This SonicWall SMA1000 flaw doesn’t require any login details or user action.
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
A successful attacker gets to features that should not be seen. From there, the second problem can allow access to running code. SonicWall says both are already being attacked.
How the Attack Works
CVE-2026-83548 is found in the SMA1000 Work Place system. The notice calls it an SSRF because of an unexpected access path. This means the device works like an accidental forward proxy.
A remote attacker can access sensitive functions without needing to log in. The warning says they might “do things without permission.” The second issue, CVE-2026-83549, lets an admin use command injection in the Management Console. This means the admin can run any commands they want. The report does not share details on how to exploit it.
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-83549 | 7.8 | CWE-78 | Exploited in the wild |
| CVE-2026-83548 | Awaiting analysis | CWE-441 | Exploited in the wild |
Exploitation Status
SonicWall says this SonicWall SMA1000 problem is being actively used by attackers. Its PSIRT looked into a situation that showed real attacks happening. This is similar to a July 2026 SMA1000 event, where attackers combined a similar pre-auth SSRF with a bug that allowed code to run.
Affected Versions
The flaws affect SMA1000 models 6210, 7210, and 8200v. At-risk versions include 12.4.3-03453 and older, as well as 12.5.0-02835 and older. The issues do not affect SMA 100 Series devices or firewall SSL-VPN.
Patch and Mitigation Steps
No workaround exists, so patching is the only fix. Upgrade to 12.4.3-03526 or 12.5.0-02952, or later, from mysonicwall.com.
