SonicWall Confirms Active Exploitation of Two SMA 1000 Vulnerabilities
SonicWall confirmed the active exploitation of a critical SSRF flaw and an RCE vulnerability in SMA 1000 Series devices. Hotfixes are available for the affected versions.
SonicWall SMA 1000 vulnerabilities are being actively exploited, according to the manufacturer. On September 1, 2026, the company published notice SNWLID-2026-0016 covering two flaws in SMA 1000 Series devices and released corrective hotfixes. Organizations with affected systems should update the software and check for possible signs of compromise.
The flaws are designated CVE-2026-83548 and CVE-2026-83549. The first has a maximum CVSS score of 10.0 and is a pre-authentication SSRF vulnerability through an unintended forward proxy function. The second flaw is a post-authentication vulnerability enabling remote code execution (RCE), with a CVSS rating of 7.8.
SonicWall SMA 1000 vulnerabilities affect specific versions
The notice applies to the SMA 6210, SMA 7210, and virtual SMA 8200v models. Devices on software branches 12.4.3-03453 and 12.5.0-02835 are affected.
SonicWall prepared hotfixes for both branches:
- version 12.4.3-03526 fixes deployments on the 12.4.3 branch,
- version 12.5.0-02952 fixes deployments on the 12.5.0 branch.
The manufacturer explicitly confirmed that both flaws are being actively exploited. However, the published materials do not identify the attacker, the scope of affected organizations, or the specific techniques used in the attacks.
Why possible compromise must also be investigated
SMA devices provide remote access to corporate networks, so their compromise may also affect an organization’s internal environment. CVE-2026-83548 is a pre-authentication SSRF vulnerability with a CVSS rating of 10.0.
The second flaw, CVE-2026-83549, requires authentication but may lead to remote code execution. Public materials do not technically describe whether or how attackers are combining both vulnerabilities into a single attack chain. SonicWall did not explicitly confirm such a scenario in its notice.
The vendor recommends deploying the relevant hotfix without delay and checking the device for indicators of compromise. However, it did not publish specific indicators in the available notice.
If an organization finds signs of an attack, SonicWall recommends reinstalling or redeploying the device, changing passwords, and resetting TOTP tokens. The update itself removes the vulnerability, but it does not replace a response to a possible intrusion that has already occurred.
What is not yet known
It has not been confirmed whether CVE-2026-83548 or CVE-2026-83549 has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The published information likewise does not mention forensic findings, malware, credential theft, or ransomware cases directly linked to these flaws.
Further information may come from potential technical indicators of compromise from SonicWall, independent analyses of the attacks, or the addition of the flaws to the CISA KEV catalog. For administrators of affected SMA 1000 devices, however, a fix and the manufacturer’s procedure for suspected compromise are already available.
Sources
- SonicWall Product Notice SNWLID-2026-0016 – Confirms the CVEs, affected models and versions, active exploitation, corrective hotfixes, and the recommended procedure in cases of possible compromise.
- SecurityWeek – Independently summarizes the SonicWall notice and states that public information does not yet contain attack details or IoCs.
Verified and updated: 09/02/2026 07:37
