SonicWall SMA1000: The Front Door Had a Side Door, and Attackers Used Both

Two SMA1000 zero-days chain into unauthenticated RCE

SonicWall disclosed two actively exploited flaws in its SMA1000 secure remote-access appliances on September 1, tracked as CVE-2026-83548 and CVE-2026-83549. The first is a pre-authentication server-side request forgery (SSRF) in the Appliance Work Place interface, rated CVSS 10.0. The second is an OS command injection in the Appliance Management Console (AMC), rated CVSS 7.8. On its own, the injection needs an authenticated administrator. Chained with the SSRF, it gives an unauthenticated attacker remote code execution on the gateway that sits between remote users and everything behind them.

Affected models are SMA1000 6210, 7210, and 8200v. Vulnerable builds include 12.4.3-03453 platform-hotfix and earlier, and 12.5.0-02835 platform-hotfix and earlier. Fixed releases are 12.4.3-03526 and 12.5.0-02952 (and higher). SonicWall says SSL-VPN on its firewalls and the SMA 100 series are not in scope. CISA added both CVEs to the Known Exploited Vulnerabilities catalog on September 2 under BOD 26-04.

Work Place is the public-facing side of the appliance. AMC is the management console and should stay internal. CVE-2026-83548 breaks that separation through an unintended alternate access path. Reporting on /wsproxy describes how a crafted request can make the appliance proxy into management as if the request came from localhost. Once an attacker can reach AMC that way, CVE-2026-83549 lets them run OS commands.

SonicWall states it discovered the flaws and their exploitation internally. Open reporting has little public proof-of-concept detail and few vendor IoCs for this September pair so far. That doesn’t mean nobody is looking. Rapid7 is blunt: exploitation was occurring before disclosure, so patch status alone does not answer whether an internet-facing appliance was already taken.

Whoever controls the gateway inherits remote-access trust

An SMA1000 runs remote access: VPN, application proxy and the identity handshake remote workers rely on. An attacker who controls it inherits session trust, a route to the directory and a privileged view into internal applications. Changing passwords afterward is necessary, but you still have to prove the appliance itself is clean.

SonicWall has been here before. Earlier SMA1000 SSRF/RCE chains in 2026 already forced operators to re-image appliances and reset TOTP. When a product family keeps shipping bugs that let the public interface reach the private console, incident response should plan for stolen configuration and credentials as well as the hotfix install.

Federal agencies reading KEV entries under BOD 26-04 face compressed timelines and forensic-triage expectations for high-risk exposed assets. Commercial teams without a federal mandate are in the same spot. The exposure window opened before the advisory, and every day an unpatched remote-access gateway stays online gives an attacker more time to set up their own tunnel.

Patch to 12.4.3-03526 or 12.5.0-02952, then hunt

• Inventory every SMA1000. Confirm models 6210 / 7210 / 8200v and exact platform-hotfix builds. Anything at or below 12.4.3-03453 or 12.5.0-02835 needs 12.4.3-03526 or 12.5.0-02952 (or newer) immediately.
• Treat internet-exposed Work Place as priority IR. Preserve appliance logs, reverse-proxy/WAF logs covering the Work Place hostname, and any outbound connections from the appliance before reboot or wipe.
• Hunt for management-plane abuse. Look for anomalous requests into Work Place proxy paths (including /wsproxy), unexpected AMC activity, new admin accounts, altered routes, and configuration changes that do not match change tickets.
• Look past the patch. If compromise indicators appear, or if the appliance was exposed during the pre-disclosure window with weak logging, re-image hardware or redeploy virtual appliances, rotate all user and administrator passwords, and reset TOTP seeds.
• Assume credential reuse. Rotate secrets that lived on or behind the gateway: LDAP/bind accounts, RADIUS shared secrets, certificates, API tokens, and any vault paths the appliance could reach.
• Limit what the next attacker can reach. Prefer private management access, MFA everywhere the console allows it, and network controls that keep AMC unreachable from the public internet even if Work Place must remain reachable.

Sources

• Rapid7: Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
• SecurityWeek: SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks
• CISA: Adds Seven Known Exploited Vulnerabilities to Catalog (Sept 2, 2026)

Install the named hotfixes, then check that nobody else controls the gateway your remote staff log in through.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].