Critical SonicWall SMA 1000 Vulnerabilities Actively Exploited in the Wild

SonicWall has issued an urgent security advisory regarding two vulnerabilities affecting its SMA 1000 Series secure access appliances. The company warns that there have been cases indicating active exploitation in the wild.

The vulnerabilities are tracked as CVE-2026-83548 and CVE-2026-83549 and impact SonicWall SMA 1000 models 6210, 7210, and 8200v that are running vulnerable platform hotfix releases. The more severe issue, CVE-2026-83548, has received a maximum CVSS v3 score of 10.0 and can be exploited remotely without authentication.

SonicWall SMA 1000 Vulnerabilities

CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF) vulnerability found in the SMA 1000 Appliance Workplace interface.

According to SonicWall, this vulnerability can create an unintended access path that allows the appliance to function as an unintended forward proxy.

An unauthenticated remote attacker could exploit this flaw to access sensitive functionality and perform unauthorized operations. The vulnerability is associated with CWE-918 (Server-Side Request Forgery) and CWE-441 (Unintended Proxy or Intermediary), often referred to as a “confused deputy” issue.

The CVSS vector for this vulnerability is: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

This indicates that the exploitation is network-accessible, has low attack complexity, requires no privileges, and involves no user interaction. Successful exploitation can impact the confidentiality, integrity, and availability of systems beyond the appliance’s security boundary.

The second vulnerability, CVE-2026-83549, is a post-authentication remote code execution issue in the SMA 1000 Appliance Management Console (AMC). This flaw arises from improper neutralization of special elements in operating system commands, a common attack known as OS command injection.

A remote attacker, once authenticated as an administrator, could exploit this issue under specific conditions to execute arbitrary commands on the underlying operating system. CVE-2026-83549 has a CVSS v3 score of 7.8 and is mapped to CWE-78.

Although it requires administrator-level authentication and local attack-vector conditions in its CVSS assessment, it remains a serious risk in environments where credentials have been stolen, reused, or obtained through the exploitation of another vulnerability.

Affected and Fixed Versions

Affected versions include:

Product	Vulnerable versions	Fixed versions
SMA 1000 Models 6210, 7210, 8200v	12.4.3-03453 platform-hotfix and earlier	12.4.3-03526 platform-hotfix and later
SMA 1000 Models 6210, 7210, 8200v	12.5.0-02835 platform-hotfix and earlier	12.5.0-02952 platform-hotfix and later

SonicWall confirmed that SSL-VPN services running on SonicWall firewalls and the SMA 100 Series product line are not affected by these vulnerabilities.

There is no workaround available. Organizations using physical or virtual SMA 1000 appliances should immediately install the latest available platform hotfix from MySonicWall.

SonicWall also recommends contacting Technical Support to review appliances for signs of compromise. If any evidence of compromise is found, administrators should re-image affected hardware appliances or redeploy virtual instances, change all user and administrator passwords, and reset all TOTP tokens.

Given the confirmed exploitation and unauthenticated nature of CVE-2026-83548, organizations with internet-exposed SMA 1000 deployments should treat this as a high-priority incident response and patching concern.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.