# Two SonicWall SMA1000 Zero-Days Are Already Being Exploited

Page: https://hirantha.me/blog/two-sonicwall-sma1000-zero-days-are-already-being-exploited
Published: 2026-09-03
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: sonicwall, sma1000, zero-day vulnerability, remote code execution, vpn appliance security

> SonicWall's SMA1000 appliances face two zero-days, one rated CVSS 10.0, being chained for remote code execution without valid credentials.

## What happened

SonicWall disclosed two previously unknown flaws in its SMA1000 line of secure remote access appliances on September 1, 2026, and confirmed both are already being exploited. SMA1000 boxes sit at the edge of a corporate network and let employees tunnel in remotely, which is exactly why an attacker who compromises one can often walk straight into the rest of the network.

The more serious of the pair, tracked as CVE-2026-83548, carries the maximum possible severity score: CVSS 10.0. It is a server-side request forgery (SSRF) bug in the appliance's Work Place interface, and critically, it needs no authentication at all. The second, CVE-2026-83549, is an OS command injection flaw rated CVSS 7.8 in the Appliance Management Console, but on its own it requires an attacker to already hold admin-level credentials.

## How the chain works

Neither bug alone is the real story. What makes this exploitable end to end is that attackers are stringing the two together. The unauthenticated SSRF flaw gets an attacker into the management plane without any credentials, and the command injection flaw then lets them run arbitrary operating-system commands from there. The result is full remote code execution on an internet-facing appliance, with no valid username or password required at any point in the chain.

SonicWall found and disclosed both flaws itself, crediting researchers William Perry and Adam Babis, and it has confirmed active exploitation in the wild. The company has not published indicators of compromise, and no threat actor has been publicly named for this specific campaign.

## Who is affected

The flaws hit three SMA1000 models: the 6210, 7210, and 8200v. Vulnerable firmware is 12.4.3-03453 and earlier, or 12.5.0-02835 and earlier. Two product lines that share the SMA branding are explicitly not affected: SonicWall's separate SMA100 series, and the SSL-VPN feature built into SonicWall's firewalls.

A scan by Shadowserver around the time of disclosure found more than 400 SMA1000 appliances still reachable from the open internet, meaning the exposed population is not small.

## What SonicWall is telling customers to do

Fixes are available in firmware 12.4.3-03526, 12.5.0-02952, and later, and SonicWall's guidance goes beyond just patching. The company is telling administrators to reset every user and admin password, reset all TOTP (time-based one-time password) multi-factor authentication tokens, and, if there is any reason to suspect an appliance was already compromised, to fully re-image it rather than trust a patch alone to remove an attacker's foothold.

As of publication, the two CVEs had not yet been added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, which already lists 17 separate SonicWall flaws.

## A pattern, not an isolated incident

This is the third SMA1000 security incident within about nine months. In July 2026, a group tracked as UTA0533 exploited a different pair of SMA1000 flaws, CVE-2026-15409 and CVE-2026-15410, to deploy custom malware called KNUCKLEBALL. Before that, in December 2025, a separate SMA1000 zero-day, CVE-2025-40602, was used for root privilege escalation. Three distinct exploited zero-day incidents on the same appliance line in under a year is an unusually tight cadence, even by the standards of edge network gear, which has been a favorite target for attackers across multiple vendors in recent years.

## What it means in practice

If your organization runs SonicWall SMA1000 appliances, treat this as urgent rather than routine patch-cycle work. Check your firmware version against the vulnerable ranges above, apply the hotfix immediately, and follow SonicWall's full remediation steps, not just the patch. Because the exploit chain requires no valid credentials to start, a password reset alone will not undo a compromise that already happened; if the appliance was internet-facing and unpatched at any point since disclosure, re-imaging is the safer assumption. Given the exposed-appliance count Shadowserver found, do not assume obscurity is protecting your deployment.

It is also worth checking whether your monitoring would even catch this kind of intrusion. Because the chain starts with an unauthenticated request rather than a stolen credential, the usual signal security teams watch for, an unfamiliar login, will not fire. Log review should focus instead on unexpected outbound connections and command execution originating from the appliance itself. If you do not run SMA1000 gear, the broader lesson still applies: remote-access appliances are high-value, high-exposure targets, and repeated incidents on the same product line are a signal to review how quickly your organization can patch and rotate credentials on that class of device, not just this one.

## Questions

**What does SonicWall's SMA1000 appliance actually do?**
It is a secure remote access gateway that lets employees tunnel into an internal corporate network from outside, which is why a compromised unit can expose the whole network.

**Am I affected if I only use a SonicWall firewall?**
No, these two flaws are specific to the SMA1000 line and do not affect the SSL-VPN feature in SonicWall firewalls or the separate SMA100 series.

**What should administrators do right now?**
Patch to firmware 12.4.3-03526, 12.5.0-02952, or later immediately, reset all passwords and TOTP multi-factor tokens, and re-image any appliance where compromise is suspected rather than relying on the patch alone.

**Is there a public indicator-of-compromise list to check against?**
No, SonicWall has not published indicators of compromise as of this writing, and no attacker group has been publicly named.

**Has SonicWall's SMA1000 line had zero-days before this?**
Yes, this is the third exploited SMA1000 zero-day incident in about nine months, following a July 2026 campaign that deployed KNUCKLEBALL malware and a December 2025 privilege-escalation flaw.

## Sources

- [SonicWall warns of actively exploited SMA1000 zero-day flaws](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/), BleepingComputer
- [Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain](https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html), The Hacker News
- [SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks](https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/), SecurityWeek