InfoSecBulletin Cybersecurity for mankind
SonicWall unveiled advisory SNWLID-2026-0016 on September 1, 2026. It states that two SMA1000 flaws are being actively exploited. The main issue, CVE-2026-83548, is a pre-authentication SSRF with a top score of 10.0 CVSS. The second issue, CVE-2026-83549, allows remote code execution after authentication.
Why It Matters
SMA1000 devices act as VPN gateways for businesses. Because of this, a security weakness lets remote attackers access them easily. This SonicWall SMA1000 flaw doesn’t require any login details or user action.
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
A successful attacker gets to features that should not be seen. From there, the second problem can allow access to running code. SonicWall says both are already being attacked.
How the Attack Works
CVE-2026-83548 is found in the SMA1000 Work Place system. The notice calls it an SSRF because of an unexpected access path. This means the device works like an accidental forward proxy.
A remote attacker can access sensitive functions without needing to log in. The warning says they might “do things without permission.” The second issue, CVE-2026-83549, lets an admin use command injection in the Management Console. This means the admin can run any commands they want. The report does not share details on how to exploit it.
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-83549 | 7.8 | CWE-78 | Exploited in the wild |
| CVE-2026-83548 | Awaiting analysis | CWE-441 | Exploited in the wild |
Exploitation Status
SonicWall says this SonicWall SMA1000 problem is being actively used by attackers. Its PSIRT looked into a situation that showed real attacks happening. This is similar to a July 2026 SMA1000 event, where attackers combined a similar pre-auth SSRF with a bug that allowed code to run.
Affected Versions
The flaws affect SMA1000 models 6210, 7210, and 8200v. At-risk versions include 12.4.3-03453 and older, as well as 12.5.0-02835 and older. The issues do not affect SMA 100 Series devices or firewall SSL-VPN.
Patch and Mitigation Steps
No workaround exists, so patching is the only fix. Upgrade to 12.4.3-03526 or 12.5.0-02952, or later, from mysonicwall.com.
