What happened
SonicWall disclosed two previously unknown flaws in its SMA1000 line of secure remote access appliances on September 1, 2026, and confirmed both are already being exploited. SMA1000 boxes sit at the edge of a corporate network and let employees tunnel in remotely, which is exactly why an attacker who compromises one can often walk straight into the rest of the network.
The more serious of the pair, tracked as CVE-2026-83548, carries the maximum possible severity score: CVSS 10.0. It is a server-side request forgery (SSRF) bug in the appliance's Work Place interface, and critically, it needs no authentication at all. The second, CVE-2026-83549, is an OS command injection flaw rated CVSS 7.8 in the Appliance Management Console, but on its own it requires an attacker to already hold admin-level credentials.
How the chain works
Neither bug alone is the real story. What makes this exploitable end to end is that attackers are stringing the two together. The unauthenticated SSRF flaw gets an attacker into the management plane without any credentials, and the command injection flaw then lets them run arbitrary operating-system commands from there. The result is full remote code execution on an internet-facing appliance, with no valid username or password required at any point in the chain.
SonicWall found and disclosed both flaws itself, crediting researchers William Perry and Adam Babis, and it has confirmed active exploitation in the wild. The company has not published indicators of compromise, and no threat actor has been publicly named for this specific campaign.
Who is affected
The flaws hit three SMA1000 models: the 6210, 7210, and 8200v. Vulnerable firmware is 12.4.3-03453 and earlier, or 12.5.0-02835 and earlier. Two product lines that share the SMA branding are explicitly not affected: SonicWall's separate SMA100 series, and the SSL-VPN feature built into SonicWall's firewalls.
A scan by Shadowserver around the time of disclosure found more than 400 SMA1000 appliances still reachable from the open internet, meaning the exposed population is not small.
What SonicWall is telling customers to do
Fixes are available in firmware 12.4.3-03526, 12.5.0-02952, and later, and SonicWall's guidance goes beyond just patching. The company is telling administrators to reset every user and admin password, reset all TOTP (time-based one-time password) multi-factor authentication tokens, and, if there is any reason to suspect an appliance was already compromised, to fully re-image it rather than trust a patch alone to remove an attacker's foothold.
As of publication, the two CVEs had not yet been added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, which already lists 17 separate SonicWall flaws.
A pattern, not an isolated incident
This is the third SMA1000 security incident within about nine months. In July 2026, a group tracked as UTA0533 exploited a different pair of SMA1000 flaws, CVE-2026-15409 and CVE-2026-15410, to deploy custom malware called KNUCKLEBALL. Before that, in December 2025, a separate SMA1000 zero-day, CVE-2025-40602, was used for root privilege escalation. Three distinct exploited zero-day incidents on the same appliance line in under a year is an unusually tight cadence, even by the standards of edge network gear, which has been a favorite target for attackers across multiple vendors in recent years.
What it means in practice
If your organization runs SonicWall SMA1000 appliances, treat this as urgent rather than routine patch-cycle work. Check your firmware version against the vulnerable ranges above, apply the hotfix immediately, and follow SonicWall's full remediation steps, not just the patch. Because the exploit chain requires no valid credentials to start, a password reset alone will not undo a compromise that already happened; if the appliance was internet-facing and unpatched at any point since disclosure, re-imaging is the safer assumption. Given the exposed-appliance count Shadowserver found, do not assume obscurity is protecting your deployment.
It is also worth checking whether your monitoring would even catch this kind of intrusion. Because the chain starts with an unauthenticated request rather than a stolen credential, the usual signal security teams watch for, an unfamiliar login, will not fire. Log review should focus instead on unexpected outbound connections and command execution originating from the appliance itself. If you do not run SMA1000 gear, the broader lesson still applies: remote-access appliances are high-value, high-exposure targets, and repeated incidents on the same product line are a signal to review how quickly your organization can patch and rotate credentials on that class of device, not just this one.
