SonicWall has disclosed two new actively exploited zero-day vulnerabilities in its SMA1000 secure remote access appliances, different from the pair disclosed in July. The first, CVE-2026-83548, is a maximum-severity command injection flaw in the SMA1000 Appliance WorkPlace interface that stems from a server-side request forgery (SSRF) weakness and can be triggered without any authentication. The second, CVE-2026-83549, is a command injection bug in the Appliance Management Console that requires admin credentials. Attackers are chaining the two together: CVE-2026-83548 provides the initial unauthenticated foothold, which is then leveraged to reach CVE-2026-83549 and execute arbitrary operating system commands on the device. SonicWall’s Product Security Incident Response Team confirmed active exploitation in the wild and urged immediate patching.
SMA1000 appliances are widely deployed in large enterprises, government agencies, and critical infrastructure as secure remote access gateways, making them high-value targets. Internet security watchdog Shadowserver currently tracks over 400 SMA1000 units exposed directly to the internet, though some may already be patched. This is at least the third separate zero-day chain to hit the SMA1000 line in under a year: the July flaws (CVE-2026-15409 and CVE-2026-15410) were subsequently weaponized by INC ransomware, and a December 2025 flaw (CVE-2025-40602) was chained by state-backed actors for root access. SonicWall is advising all customers to upgrade to the latest hotfix, and to re-image appliances and reset all passwords and TOTP tokens if any indicators of compromise are found.
How to check if you’re affected
Affected products are SonicWall SMA1000 appliances — specifically models 6210, 7210, and 8200v — running firmware versions before the newly released hotfix. The SMA 100 Series and SonicWall SSL-VPN running directly on firewalls are not affected.
- Log in to your SMA1000 management console and check the installed firmware version.
- Compare it against SonicWall’s advisory to confirm you are running the hotfix build.
- If indicators of compromise are present, SonicWall recommends re-imaging the appliance, changing all user and administrator passwords, and resetting TOTP (multi-factor authentication) tokens.
- Check Shadowserver’s feed for your organization’s IP range to see if your appliance is publicly visible.