Critical SonicWall RCE Flaws Exploited in Attacks, Patch Now

Key Takeaways

• SonicWall has issued an urgent warning regarding two critical vulnerabilities in its SMA1000 Series secure mobile access appliances.
• These flaws, CVE-2026-83548 and CVE-2026-83549, are actively being exploited by attackers.
• CVE-2026-83548, a pre-authentication server-side request forgery (SSRF), boasts a maximum CVSS score of 10.0, allowing unauthenticated remote access to sensitive functions.
• CVE-2026-83549 is a post-authentication remote code execution (RCE) vulnerability with a CVSS score of 7.8.
• Immediate patching is required, as no workarounds exist, and organizations are advised to check for signs of compromise.

SonicWall has issued a critical alert, confirming that threat actors are actively exploiting two severe vulnerabilities within its SMA1000 Series secure mobile access appliances. These weaknesses could enable unauthenticated attackers to access sensitive internal functionality and allow authenticated administrators to execute arbitrary operating system commands, posing a significant risk to enterprise networks.

The vendor’s Product Security Incident Response Team (PSIRT) published advisory SNWLID-2026-0016 on September 1, 2026, following investigations that revealed evidence of ongoing exploitation. SonicWall is urging all affected organizations to immediately apply the provided platform hotfixes and conduct thorough reviews of their exposed systems for any indicators of compromise.

The vulnerabilities impact SMA1000 appliances including models 6210, 7210, and 8200v running software version 12.4.3-03453 or earlier, as well as those on version 12.5.0-02835 or earlier. SonicWall has clarified that its SSL-VPN services on SonicWall firewalls and the SMA 100 Series product line are not affected by these specific issues.

Critical RCE Flaws Under Active Attack

The most severe of the two issues is tracked as CVE-2026-83548, earning a critical CVSS score of 10.0. This pre-authentication server-side request forgery (SSRF) vulnerability resides within the SMA1000 Appliance Workplace interface.

SonicWall’s analysis indicates that the flaw originates from an unintended alternate access pathway that functions as a forward proxy. This allows a remote, unauthenticated attacker to leverage the path to reach sensitive internal functionalities and perform unauthorized operations, effectively bypassing security controls. The vulnerability is categorized under CWE-918 (Server-Side Request Forgery) and CWE-441 (Unintended Proxy or Confused Deputy).

SSRF vulnerabilities are particularly dangerous in remote-access infrastructure because they enable attackers to initiate requests directly from the compromised device, potentially circumventing network segmentation and other security measures designed to protect internal services.

The second vulnerability, CVE-2026-83549, addresses a post-authentication remote code execution (RCE) flaw found in the SMA1000 Appliance Management Console. This vulnerability carries a CVSS score of 7.8 and is attributed to improper neutralization of special characters within operating system commands.

Exploiting this command injection flaw requires an authenticated attacker with administrator privileges, who could then execute arbitrary commands on the appliance’s underlying operating system. While requiring prior authentication, this vulnerability becomes especially critical when combined with other weaknesses that could provide unauthorized access to appliance functions.

Remote access infrastructure remains a high-value target for attackers due to its strategic position at the network edge, often managing user authentication, VPN connectivity, and access to critical internal resources. A successful compromise of an SMA appliance can provide attackers with a critical foothold for credential theft, lateral movement, and broader network intrusion.

What You Should Do

• Immediately upgrade SMA1000 appliances to version 12.4.3-03526 or later, or to version 12.5.0-02952 or later, depending on the software branch deployed. There are no workarounds for these vulnerabilities.
• SonicWall also recommends contacting technical support to review appliances for indicators of compromise.
• If any indicators of compromise are discovered, re-image affected physical appliances or redeploy affected virtual appliances.
• After re-imaging or redeploying, change all user and administrator passwords and reset all TOTP tokens to invalidate any potentially stolen authentication factors.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.