CVE-2026-83548 & CVE-2026-83549: SonicWall SMA1000 Zero-Days Exploited in the Wild

Published 2026-10-08 · Last updated 2026-10-08

What’s going on

The SonicWall SMA1000 is a secure-remote-access appliance: it’s what staff log into from home to reach internal apps. That puts it on the internet by design, which is why attackers keep going after it.

• CVE-2026-83548: the Work Place (user portal) interface has an unintended alternate access path. A remote, unauthenticated attacker can use it as a server-side request forgery to reach functionality that should require a login.
• CVE-2026-83549: the Appliance Management Console (AMC) passes input to the operating system without sanitising it, so an attacker with admin access can run arbitrary OS commands.

Security researchers report the two being chained: the SSRF gets past authentication, the command injection turns that into code execution on the appliance. SonicWall confirmed both were exploited before a patch existed.

This keeps happening

This is the second pair of exploited SMA1000 bugs in two months. CISA added CVE-2026-15409 (SSRF) and CVE-2026-15410 (code injection) to its exploited list on 2026-07-14, both flagged as known ransomware use; they were fixed in builds after 12.4.3-03434 and 12.5.0-02800 (SNWLID-2026-0008), so the September hotfix covers them too. Edge VPN and remote-access appliances from every major vendor (SonicWall, Fortinet, Ivanti, Citrix) are now among the most common ways into small and mid-sized businesses. Patching within days, not weeks, is the only thing that keeps up.

Am I affected?

1. Log in to the AMC and check the firmware version on the dashboard (or under System Configuration).
2. If it’s 12.4.3-03453 or older on the 12.4 branch, or 12.5.0-02835 or older on 12.5, you’re vulnerable.
3. Check whether the Work Place portal is reachable from the internet. It almost always is; that’s its job.

SMA100-series and SonicWall firewalls (TZ/NSa) are different products and aren’t covered by this advisory. Check SonicWall’s PSIRT for those separately.

How to patch

Branch	Vulnerable	Install
12.4.3	03453 platform-hotfix and older	12.4.3-03526
12.5.0	02835 platform-hotfix and older	12.5.0-02952

Download from MySonicWall and apply through the AMC. Take a configuration backup first. Schedule it now: CISA gave federal agencies three days, which tells you how urgent they consider it.

Until you patch

• Restrict the management console (AMC) to an internal management network or a short allowlist of admin IPs. It should never be reachable from the internet.
• If the business can survive a few hours without remote access, take the Work Place portal offline until the hotfix is in.
• Make sure admin accounts use strong, unique passwords and MFA.

If it was exposed and unpatched: assume compromise

CISA flagged these for forensic triage, meaning it expects that patching alone may not remove an attacker who already got in. If your appliance was internet-facing on a vulnerable build:

• Review the AMC for admin accounts, SSH keys, or configuration changes nobody on your team made.
• Export and review the appliance logs for logins and management actions from unfamiliar IPs.
• Reset passwords for every account that authenticates through the SMA, and rotate any credentials or certificates stored on it.
• Check the internal systems the SMA can reach for new accounts, remote-access tools, or scheduled tasks.
• Contact SonicWall support. They can help with appliance-level integrity checks.

Sources

• SonicWall PSIRT SNWLID-2026-0016
• CISA: Adds Seven Known Exploited Vulnerabilities (2026-09-02)
• CVE-2026-83548 · CVE-2026-83549 (CVE.org)

← Back to Knowledge Base