InfoSecBulletin Cybersecurity for mankind
SonicWall unveiled advisory SNWLID-2026-0016 on September 1, 2026. It states that two SMA1000 flaws are being actively exploited. The main issue, CVE-2026-83548, is a pre-authentication SSRF with a top score of 10.0 CVSS. The second issue, CVE-2026-83549, allows remote code execution after authentication.
Why It Matters
SMA1000 devices act as VPN gateways for businesses. Because of this, a security weakness lets remote attackers access them easily. This SonicWall SMA1000 flaw doesn’t require any login details or user action.
SonicWall SMA1000 SSRF Hits 10, Exploiting CVE-2026-83548
Gartner
70% of SOCs Will Pilot AI Agents: Only 15% Will See Results
CVE-2026-62911
Nearly 22,000 Microsoft Exchange Servers are vulnerable to attack
CISA alerts on multiple PaperCut NG/MF flaws being actively exploited
Fire Ant hackers convert Cisco routers into spy platforms
Five Critical WordPress Flaws Lead to Site Takeover or RCE
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 Airports
A successful attacker gets to features that should not be seen. From there, the second problem can allow access to running code. SonicWall says both are already being attacked.
How the Attack Works
CVE-2026-83548 is found in the SMA1000 Work Place system. The notice calls it an SSRF because of an unexpected access path. This means the device works like an accidental forward proxy.
A remote attacker can access sensitive functions without needing to log in. The warning says they might “do things without permission.” The second issue, CVE-2026-83549, lets an admin use command injection in the Management Console. This means the admin can run any commands they want. The report does not share details on how to exploit it.
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-83549 | 7.8 | CWE-78 | Exploited in the wild |
| CVE-2026-83548 | Awaiting analysis | CWE-441 | Exploited in the wild |
Exploitation Status
SonicWall says this SonicWall SMA1000 problem is being actively used by attackers. Its PSIRT looked into a situation that showed real attacks happening. This is similar to a July 2026 SMA1000 event, where attackers combined a similar pre-auth SSRF with a bug that allowed code to run.
Affected Versions
The flaws affect SMA1000 models 6210, 7210, and 8200v. At-risk versions include 12.4.3-03453 and older, as well as 12.5.0-02835 and older. The issues do not affect SMA 100 Series devices or firewall SSL-VPN.
Patch and Mitigation Steps
No workaround exists, so patching is the only fix. Upgrade to 12.4.3-03526 or 12.5.0-02952, or later, from mysonicwall.com.
