Back Ground.News

SonicWall warns of actively exploited SMA1000 zero-day flaws

Ground.News • September 2, 2026

SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks. [...]

Remote Access Sonicwall SMA1000: Attackers Bend Internal Services

Attackers are currently exploiting two vulnerabilities in Sonicwall SMA1000. Meanwhile, the developers have closed the vulnerabilities.

SonicWall Confirms Active Attacks on Two Zero-Day Failures in SMA 1000 Applications

Two previously undisclosed vulnerabilities in the SonicWall SMA 1000 applications are being actively exploited, as confirmed by the manufacturer, who asked to install a hotfix immediately and review the systems in of compromise.

Major Security Vendor Warns of Attacks via Vulnerability: You Should Patch Immediately

The major American cyber vendor SonicWall has once again discovered that its products are being misused to carry out cyberattacks - the third time in the past year.

SonicWall SMA 1000 appliances under attack via zero-day flaws

Attackers are exploiting two previously undisclosed vulnerabilities (CVE-2026-83548, CVE-2026-83549) in SonicWall SMA 1000 appliances, the vendor confirmed on Tuesday. The vulnerabilities (CVE-2026-83548, CVE-2026-83549) The SonicWall SMA 1000 series is a line of secure remote access appliances (SSL VPN gateways) built for scale. They are used regularly by medium to large enterprises, government agencies, and managed security service providers. …

SonicWall SMA1000 Hit by Second Zero-Day Chain in Seven Weeks, Same SSRF-to-Injection Pattern

SonicWall has disclosed a second zero-day chain affecting its SMA1000 series appliances within seven weeks. The vulnerabilities, detailed in SonicWall advisory SNWLID-2026-0016, consist of CVE-2026-83548, a pre-authentication server-side request forgery (SSRF) in the Appliance Work Place interface, and CVE-2026-83549, a post-authentication OS command injection in the AMC component. Both flaws are actively exploited in the […]

100 % of the sources are Center

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SonicWall SMA1000 Faces Critical Zero-Day Exploitation SonicWall disclosed two critical vulnerabilities in its SMA1000 series appliances, CVE-2026-83548 and CVE-2026-83549, which are being actively exploited. CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF) vulnerability rated 10.0 on the CVSS scale, allowing unauthenticated attackers to access sensitive functionality. CVE-2026-83549 is a post-authentication OS command injection flaw rated 7.8, enabling attackers with admin access to execute arbitrary commands. Both vulnerabilities can be chained for unauthenticated remote code execution (RCE). Affected models include the SMA1000 series 6210, 7210, and 8200v, with SonicWall urging immediate patching to versions 12.4.3-03526 or 12.5.0-02952. The vulnerabilities were confirmed as being exploited in the wild as of September 1, 2026. Organizations are advised to review their systems for signs of compromise and reset credentials if any indicators are found. 123 sources 81

Extracted Entities

SonicWall warns of actively exploited SMA1000 zero-day flaws

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (2)

MITRE ATT&CK (1)