{"id":"sonicwall-sma1000-ssrf-rce-attacks-sep-2026","category":"patch","status":"closed","title":"SonicWall SMA1000 appliances: CVE-2026-83548 and CVE-2026-83549 exploited; hotfixes available","tldr":"SonicWall SMA1000 remote-access appliances (6210, 7210, 8200v) have two flaws used in attacks: a login-free request-forgery bug (CVSS 10) and an admin-level command flaw. Hotfixes exist. Businesses should apply them and ask SonicWall to check for compromise.","summary":"SonicWall disclosed on 1 September 2026 that two flaws in its SMA1000 secure remote access appliances (models 6210, 7210 and 8200v) were being exploited. CVE-2026-83548, rated 10.0, is a server-side request forgery in the Work Place interface that lets an unauthenticated attacker make the appliance send requests into the network behind it. CVE-2026-83549, rated 7.8, is an operating system command injection in the Appliance Management Console that lets an administrator-level user run commands; Rapid7 reports the two can be chained for remote code execution without a login. Affected builds are 12.4.3-03453 and earlier and 12.5.0-02835 and earlier. Rapid7 lists fixes in platform hotfixes 12.4.3-03526 and 12.5.0-02952 or higher. No workaround other than the hotfix has been reported. SonicWall has not published indicators of compromise or attacker details, and Rapid7 says exploitation began before disclosure. SMA100 appliances and SonicWall firewalls are not affected. CISA lists both flaws as exploited. This is mainly a business risk, though some wealthy households and family offices run these appliances.","action":"Apply the SonicWall hotfix (12.4.3-03526 or 12.5.0-02952 or higher) now, then contact SonicWall Technical Support to check for signs of compromise. If an appliance is compromised, re-image or redeploy it, change all user and admin passwords and reset TOTP tokens.","product":"SonicWall SMA1000 series appliances (6210, 7210, 8200v)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-83548","CVE-2026-83549"],"tags":["sonicwall","sma1000","vpn","remote-access","ssrf","command-injection","zero-day","cisa-kev"],"affected":["SMA1000 6210, 7210 and 8200v running 12.4.3-03453 (platform-hotfix) and earlier","SMA1000 6210, 7210 and 8200v running 12.5.0-02835 (platform-hotfix) and earlier"],"fixed":["12.4.3-03526 (platform-hotfix) and higher","12.5.0-02952 (platform-hotfix) and higher"],"matches":[],"sources":[{"kind":"advisory","title":"SonicWall PSIRT SNWLID-2026-0016 (page did not load its content; relied on reports of it)","url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016","by":"SonicWall","date":"2026-09-01"},{"kind":"research","title":"Critical SonicWall SMA1000 vulnerabilities CVE-2026-83548, CVE-2026-83549 exploited in the wild","url":"https://rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild","by":"Rapid7","date":"2026-09-02"},{"kind":"news","title":"SonicWall SMA 1000 appliances under attack via zero-day flaws","url":"https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/","by":"Help Net Security","date":"2026-09-02"},{"kind":"advisory","title":"Active Exploitation of Vulnerabilities in SonicWall SMA1000 Series","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-114/","by":"Cyber Security Agency of Singapore","date":"2026-09-04"}],"started":"2026-09-01","closed":"2026-09-04","created":"2026-11-03T22:10:59.063Z","updated":"2026-11-03T22:10:59.063Z","cve_notes":[{"cve":"CVE-2026-83548","name":"Login-free request forgery in SonicWall SMA1000 Work Place","what":"A server-side request forgery in the Work Place interface of SMA1000 appliances that lets an unauthenticated attacker make the appliance send requests into the network behind it and reach sensitive functions.","severity":"critical","cvss":10},{"cve":"CVE-2026-83549","name":"OS command injection in SMA1000 management console","what":"An operating system command injection in the Appliance Management Console that lets an attacker with administrator access run commands on the appliance, and which Rapid7 says can be chained with CVE-2026-83548 for code execution without a login.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-09-04","added":"2026-11-03T22:09:50.672Z","kind":"other","text":"Singapore's Cyber Security Agency issued an alert saying the flaws were reportedly under active exploitation, and told users to update immediately and ask SonicWall Support to check for signs of compromise. The page was last updated 3 November 2026.","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-114/","by":"Cyber Security Agency of Singapore","patch":null},{"at":"2026-09-03","added":"2026-11-03T22:09:50.672Z","kind":"cisa-added","text":"Rapid7 reported both flaws added to CISA's Known Exploited Vulnerabilities list on 3 September; the record supplied to HARD gives 2 September. Rapid7 found no public proof-of-concept, indicators or attribution at the time.","url":"https://rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild","by":"Rapid7","patch":null},{"at":"2026-09-02","added":"2026-11-03T22:09:50.672Z","kind":"other","text":"Help Net Security reported that SonicWall's PSIRT investigated a case showing active exploitation, that no indicators of compromise had been published, and that previous SMA1000 zero-day campaigns occurred in June and July 2026 and late 2025.","url":"https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/","by":"Help Net Security","patch":null},{"at":"2026-09-01","added":"2026-11-03T22:09:50.672Z","kind":"disclosed","text":"SonicWall published advisory SNWLID-2026-0016 for the SMA1000 line, confirming that CVE-2026-83548 and CVE-2026-83549 were being exploited. A hotfix was released at the same time.","url":"https://rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild","by":"Rapid7","patch":"patched"}],"url":"https://hard.fyi/live/sonicwall-sma1000-ssrf-rce-attacks-sep-2026/","json":"https://hard.fyi/api/live?id=sonicwall-sma1000-ssrf-rce-attacks-sep-2026"}