Attackers Chain Two SonicWall SMA 1000 Zero-Days in Active Attacks

Two Chained Zero-Days, Confirmed Active Exploitation

SonicWall has released emergency security updates addressing two zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 series VPN appliances — and confirmed that attackers are actively chaining both flaws together to achieve remote code execution on internet-facing devices.

SonicWall said it "has investigated a case indicating the active exploitation of the vulnerabilities," with threat actors combining an unauthenticated request-forgery bug with a post-authentication command injection to fully compromise vulnerable appliances.

The Two Vulnerabilities

CVE-2026-83548 allows an unauthenticated remote attacker to reach sensitive internal functionality through the Work Place interface — a pre-auth SSRF that can be used as a foothold. CVE-2026-83549 then allows an authenticated administrator-level session (potentially obtained via the first flaw or via stolen credentials) to inject and execute arbitrary OS commands through the Management Console, resulting in full remote code execution on the appliance.

Both flaws were discovered internally by SonicWall researchers William Perry and Adam Babis.

Affected Products and Fixed Versions

Attack Chain

1. Attacker sends crafted request to the Appliance Work Place interface (no auth)
2. CVE-2026-83548 SSRF is used to reach internal management functionality
3. Attacker leverages the resulting access to reach the Management Console
4. CVE-2026-83549 command injection executes arbitrary OS commands
5. Full remote code execution on the SMA appliance

SonicWall's Guidance

SonicWall is urging all SMA 1000 customers to treat this as an emergency patching event:

1. Upgrade immediately to 12.4.3-03526 or 12.5.0-02952 (platform-hotfix), whichever branch applies.
2. Review appliances for indicators of compromise — SonicWall has confirmed real-world exploitation, not just theoretical risk.
3. If compromise is found or suspected, re-image the appliance rather than attempting to clean in place.
4. Reset all passwords for accounts associated with the appliance.
5. Reset all Time-based One-Time Passwords (TOTP) tied to the device, since session/token material may have been exposed.
6. Restrict management interface exposure — the Work Place and Management Console should not be reachable from the open internet where avoidable.

Why This Matters

SMA appliances sit at the network perimeter as remote-access gateways, making them a high-value target: a single successful chain gives an attacker a foothold with visibility into internal network resources reachable through the VPN tunnel. The CVSS 10.0 rating on the SSRF component reflects that it requires zero credentials and zero user interaction — combined with confirmed in-the-wild exploitation, this places SMA 1000 devices in the same urgency tier as previously exploited perimeter VPN/gateway CVEs from Citrix, Ivanti, and Fortinet earlier this year.

References

• The Hacker News — Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

Related Reading

• FalconFlank PoC Claims Zero-Day Privilege Escalation in CrowdStrike Falcon
• Citrix Urges Admins to Patch NetScaler Flaws As Soon As Possible
• Ivanti Customers Confront Yet Another Actively Exploited Zero-Day