SonicWall SMA1000 appliances: CVE-2026-83548 and CVE-2026-83549 exploited; hotfixes available
SonicWall SMA1000 remote-access appliances (6210, 7210, 8200v) have two flaws used in attacks: a login-free request-forgery bug (CVSS 10) and an admin-level command flaw. Hotfixes exist. Businesses should apply them and ask SonicWall to check for compromise.
Apply the SonicWall hotfix (12.4.3-03526 or 12.5.0-02952 or higher) now, then contact SonicWall Technical Support to check for signs of compromise. If an appliance is compromised, re-image or redeploy it, change all user and admin passwords and reset TOTP tokens.
What’s happening
SonicWall disclosed on 1 September 2026 that two flaws in its SMA1000 secure remote access appliances (models 6210, 7210 and 8200v) were being exploited. CVE-2026-83548, rated 10.0, is a server-side request forgery in the Work Place interface that lets an unauthenticated attacker make the appliance send requests into the network behind it. CVE-2026-83549, rated 7.8, is an operating system command injection in the Appliance Management Console that lets an administrator-level user run commands; Rapid7 reports the two can be chained for remote code execution without a login. Affected builds are 12.4.3-03453 and earlier and 12.5.0-02835 and earlier. Rapid7 lists fixes in platform hotfixes 12.4.3-03526 and 12.5.0-02952 or higher. No workaround other than the hotfix has been reported. SonicWall has not published indicators of compromise or attacker details, and Rapid7 says exploitation began before disclosure. SMA100 appliances and SonicWall firewalls are not affected. CISA lists both flaws as exploited. This is mainly a business risk, though some wealthy households and family offices run these appliances.
- What
- Flaw
- Affects
- SonicWall SMA1000 series appliances (6210, 7210, 8200v)
- Affected
- SMA1000 6210, 7210 and 8200v running 12.4.3-03453 (platform-hotfix) and earlier
SMA1000 6210, 7210 and 8200v running 12.5.0-02835 (platform-hotfix) and earlier - Fixed in
- 12.4.3-03526 (platform-hotfix) and higher
12.5.0-02952 (platform-hotfix) and higher - Since
- 1 Sept 2026
- Closed
- 4 Sept 2026
Timeline
- Update
Singapore's Cyber Security Agency issued an alert saying the flaws were reportedly under active exploitation, and told users to update immediately and ask SonicWall Support to check for signs of compromise. The page was last updated 3 November 2026.
- CISA added
Rapid7 reported both flaws added to CISA's Known Exploited Vulnerabilities list on 3 September; the record supplied to HARD gives 2 September. Rapid7 found no public proof-of-concept, indicators or attribution at the time.
- Update
Help Net Security reported that SonicWall's PSIRT investigated a case showing active exploitation, that no indicators of compromise had been published, and that previous SMA1000 zero-day campaigns occurred in June and July 2026 and late 2025.
- Made publicFixed
SonicWall published advisory SNWLID-2026-0016 for the SMA1000 line, confirming that CVE-2026-83548 and CVE-2026-83549 were being exploited. A hotfix was released at the same time.
Sources
- SonicWall PSIRT SNWLID-2026-0016 (page did not load its content; relied on reports of it)SonicWall · 1 Sept 2026
- Critical SonicWall SMA1000 vulnerabilities CVE-2026-83548, CVE-2026-83549 exploited in the wildRapid7 · 2 Sept 2026
- SonicWall SMA 1000 appliances under attack via zero-day flawsHelp Net Security · 2 Sept 2026
- Active Exploitation of Vulnerabilities in SonicWall SMA1000 SeriesCyber Security Agency of Singapore · 4 Sept 2026