SonicWall advises customers to patch two new SMA1000 zero-days

SonicWall on Sept. 1 warned customers that attackers were chaining two SMA1000 zero-days in remote code execution attacks and encourged users to upgrade to the latest hotfix release

The first bug — CVE-2026-83548 — operates as a maximum-severity pre-authentication server-side request forgery (SSRF) flaw. This lets an unauthenticated attacker inject requests that the appliance processes on their behalf, granting access to restricted functionality without valid credentials.

Attackers are chaining CVE-2026-83548 with CVE-2026-83549, a high-severity command injection flaw that lets an authenticated administrator execute arbitrary operating system commands on the device.

“When chained, an attacker exploits the first flaw to reach privileged functions, then uses the second to execute commands directly on the appliance that makes access decisions for an organization's entire remote workforce,” said James Edwards, senior director of engineering at Keeper Security. “From there they can harvest credentials, forge authentication tokens, intercept remote sessions and move into the network.”

Alex Wells, head of product strategy at Hadrian, said this incident reminds us that attackers don’t exploit vulnerabilities in isolation, they often look for ways to chain weaknesses together. In this case, Wells said a critical pre-authentication flaw combined with a high-severity post-authentication vulnerability can ultimately give an unauthenticated attacker remote code execution.

“A vulnerability that might appear more limited on its own can become significantly more dangerous as part of an attack path,” said Wells. “Incidents like this show why vulnerability management can’t just be a process of sorting CVEs by severity. Defenders need to understand which combinations of weaknesses can actually be exploited together to create a path into the organization."

Seemant Sehgal, chief executive officer at BreachLock, added that when two vulnerabilities are chained like this, individual severity scores stop mattering. Sehgal said what we're looking at here is an unauthenticated RCE feeding into a privilege escalation path that hands an attacker full control of the appliance.

Sehgal said organizations running SMA1000 should treat this as an active compromise scenario until they have patched, reviewed their logs for the indicators SonicWall published, and confirmed no lateral movement has already occurred.

“Days like this get much less stressful when teams already know what sits on their external attack surface and which vulnerabilities are actually exploitable in production,” said Sehgal. “A new critical CVE becomes a targeted response instead of a scramble. Teams that build that visibility in advance respond in hours instead of weeks."

Although a clear pattern has yet to emerge, SonicWall SMA1000s have been a favorite target of attackers:

Two other SonicWall SMA1000 zero-day flaws — CVE-2026-15409 and CVE-2026-15410 — were exploited in July by attackers with the aim of installing custom malware on VPN appliances. And in August, the Cybersecurity Infrastructure and Security Agency (CISA), followed up by confirming that the two July CVEs were being abused by ransomware gangs.