SonicWall patches SMA 1000 zero-days under active attack

SonicWall on September 1 published a product notice, SNWLID-2026-0016, confirming that two flaws in its SMA 1000 series remote-access appliances are under active exploitation. The notice is the vendor's own PSIRT advisory. It ships fixes rather than just a warning.

The more severe bug is CVE-2026-83548, a pre-authentication server-side request forgery caused by an unintended forward-proxy in the Appliance Work Place interface, rated CVSS 10.0 Critical. The second, CVE-2026-83549, is a post-authentication remote code execution and OS command injection flaw in the Appliance Management Console, rated 7.8 High. SonicWall says it investigated a case indicating exploitation of the described vulnerabilities in the wild.

The notice names SMA 1000 models 6210, 7210 and 8200v, physical and virtual, on firmware in the 12.4.3-03453 and 12.5.0-02835 build lines. SSL-VPN running on SonicWall firewalls is not affected, and the SMA 100 series is not affected.

The patched versions are hotfix builds 12.4.3-03526 and 12.5.0-02952, or later, available from mysonicwall.com. The SMA 1000 line has now seen a second SSRF-to-injection pattern in roughly seven weeks, after a chain disclosed in July. Internet-facing remote-access gear keeps drawing the same treatment, as the run of exploited Citrix NetScaler flaws and the Fire Ant campaign against Cisco IOS XR routers this year both showed.

Beyond the hotfix, SonicWall's own guidance is to contact its Technical Support to review appliances for indicators of compromise. If any are found, the notice says to re-image physical hardware or redeploy the virtual appliance from clean media, change every user and admin password, and reset TOTP tokens. Rotating credentials matters because a post-auth command-injection foothold outlives a simple reboot.

As of the advisory, SonicWall has not published a public list of indicators of compromise, so detection still leans on vendor support rather than a drop-in IOC feed. The pair is also not yet listed in CISA's Known Exploited Vulnerabilities catalog, even though 17 other SonicWall flaws already are, so federal patch deadlines have not attached to these two CVEs yet.

Some offers on this page may be paid placements or contain affiliate links.