Critical SonicWall SMA 1000 Zero-Day Vulnerabilities (CVE-2026-83548 & CVE-2026-83549)

SonicWall has disclosed two new vulnerabilities affecting SMA 1000 Series secure remote access appliances - CVE-2026-83548 (Server-Side Request Forgery, CVSSv3.1 10.0) and CVE-2026-83549 (OS Command Injection, CVSSv3.1 7.8) - which SonicWall has confirmed were actively exploited in the wild and which may be chained by an attacker to achieve remote code execution. This is the second SMA 1000 zero-day chain in as many months (see Triskele Labs' prior bulletin on CVE-2026-15409 and CVE-2026-15410). Organisations that already patched and investigated for compromise following that earlier incident must treat this as a separate incident and a separate investigation window - that remediation does not cover this new exploit chain. SonicWall discovered this exploitation internally and disclosed it on 2 September 2026 (SNWLID-2026-0016). As of this writing, SonicWall has not published indicators of compromise, exploitation timelines, or detailed technical root-cause information - this bulletin will be updated as more detail becomes available.

Vulnerability details

CVE-2026-83548 - Server-Side Request Forgery (SSRF)

Severity: Critical (CVSSv3.1 10.0).

Exploit status: Confirmed actively exploited in the wild (vendor-confirmed, discovered internally by SonicWall).

Vulnerability type: Pre-authentication SSRF in the SMA1000 Appliance WorkPlace interface, described by SonicWall as an unintended alternate access path that allows the appliance to act as a forward proxy (CWE-918 / CWE-441).

Exploitation requirements: No authentication or user interaction required. Public reporting indicates the flaw involves the /wsproxy WebSocket-proxy endpoint, reachable by spoofing client identifiers (User-Agent and URI parameters) to tunnel traffic to internal-only services.

Impact of this stage alone: Unauthorised access to sensitive appliance functionality and the ability to reach services normally restricted to localhost, including the Appliance Management Console.

CVE-2026-83549 - OS Command Injection

Severity: High (CVSSv3.1 7.8).

Vulnerability type: OS command injection in the SMA1000 Appliance Management Console (AMC).

Exploitation requirements: Post-authentication - requires administrator-level access to the AMC. Under specific conditions this allows a remote, authenticated administrator to execute arbitrary OS commands.

Chained impact: Security researchers have not ruled out that the pre-authentication SSRF in CVE-2026-83548 could be used to reach the AMC and satisfy the authentication precondition for CVE-2026-83549. SonicWall has not confirmed whether this is the chain actually used in the observed attacks, and no public technical write-up has yet detailed it.

Exposure condition: Applies to internet-facing SMA1000 Appliance WorkPlace interfaces - the standard, intended deployment model for these devices.

Affected & fixed systems

Note: These vulnerabilities do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line. There is no mitigating configuration - upgrading to the fixed platform-hotfix is the only remediation.

The latest platform-hotfix is available for download on mysonicwall.com .

Successful exploitation of this chain could give a remote attacker, beginning with no authentication, a path to command execution on an internet-facing remote access gateway. Given the role SMA1000 appliances play brokering credentials, sessions, and MFA data for remote users, potential impact includes:

Unauthorised access to internal-only appliance services and management functionality.

Potential arbitrary OS command execution if the SSRF is used to reach the AMC.

Downstream risk of credential harvesting, session/MFA token theft, and use of the appliance as a foothold into internal networks, though this has not yet been confirmed for this specific chain.

Over 400 internet-exposed SMA1000 appliances are currently visible to internet-wide scanning (Shadowserver), some proportion of which may already be patched.

Patch immediately - there is no workaround. SonicWall's advisory confirms active exploitation and states that all organisations with SMA1000 deployments (virtual or physical) on affected versions must:

Upgrade to the latest platform-hotfix - 12.4.3-03526 or 12.5.0-02952 (or later) - available via mysonicwall.com .

SonicWall Technical Support for assistance reviewing the system for indicators of compromise (IOCs), since SonicWall has not published a public IOC list.

Restrict administrator access to the AMC to trusted management networks only, reducing exposure to the post-authentication command injection component.

Detection capabilities

SonicWall has not published detailed IOCs, log signatures, or a confirmed exploitation timeline for this chain, and directs customers to its Technical Support team for IOC review on a case-by-case basis. Per SonicWall's guidance, if IOCs are detected on a system:

Re-image (hardware) or re-deploy (virtual) the affected appliance - do not remediate in place.

Change all user and administrator passwords associated with the appliance.

Reset TOTP/MFA tokens for all users.

Pending further public technical detail, organisations may also wish to:

Treat any internet-facing SMA1000 WorkPlace interface as a potential target, regardless of patch status prior to the hotfix.

Review AMC access logs for administrator logins from unexpected source IPs or at unusual times, given the post-auth nature of CVE-2026-83549.

Review appliance logs ( /var/log/aventail/extraweb_access.log , /var/log/aventail/access_servers.log , /var/log/aventail/ctrl-service.log ) as a starting point, watching in particular for anomalous /wsproxy -style requests.

Monitor SonicWall's advisory (SNWLID-2026-0016) and independent security research for further updates.

MDR customers: Triskele Labs will develop and tune detections for behaviours consistent with the exploitation of CVE-2026-83548 and CVE-2026-83549 across supported log sources as further technical detail becomes available.

Vulnerability Management customers: Environments will be assessed for exposed and vulnerable SMA1000 appliance versions; any findings will be communicated through priority channels.