SonicWall SMA1000 flaw chain: CISA's patch deadline has passed

SonicWall's PSIRT advisory SNWLID-2026-0016 covers two vulnerabilities in SMA1000 secure remote access appliances that the vendor confirms are being actively exploited. Both, CVE-2026-83548 and CVE-2026-83549, are on CISA's Known Exploited Vulnerabilities catalog, and the federal remediation deadline of 5 September has already passed.

How the two flaws chain together

CVE-2026-83548 (CVSS 10.0) is a pre-authentication server-side request forgery in the SMA1000 Work Place interface: the interface exposes an unintended access route that lets the appliance act as a forward proxy, so an unauthenticated remote attacker can reach internal functionality that should not be reachable from outside. CVE-2026-83549 (CVSS 7.8) is an OS command injection flaw in the Appliance Management Console that would normally require an authenticated administrator session. Chained, the SSRF flaw gets an attacker to the point where the command-injection flaw can be triggered without any credentials, resulting in unauthenticated remote code execution on internet-facing appliances. According to reporting from Rapid7 and Sophos, no public proof-of-concept, indicators of compromise or attribution had been identified at time of publication, even as SonicWall confirms exploitation is occurring.

Affected models and fix

The flaws affect SMA 6210, 7210 and 8200v appliances running firmware 12.4.3-03453 or earlier, and 12.5.0-02835 or earlier. SonicWall's fixed hotfixes are 12.4.3-03526 and 12.5.0-02952; SSL VPN on SonicWall firewalls and the separate SMA 100 series are not affected.

What to do

• Inventory every SMA1000 deployment, physical and virtual, across all tenants, recording firmware version and internet exposure.
• Upgrade to the fixed hotfix build immediately; this is not a workaround-and-wait situation given confirmed exploitation.
• Where an immediate upgrade is not possible, reduce exposure of the Work Place interface as an interim step, not a substitute for patching.
• If indicators of compromise are found, SonicWall's own guidance is to re-image physical appliances or redeploy virtual ones from scratch, change all user and administrator passwords, and reset TOTP tokens.

CISA's 5 September deadline is binding for US federal civilian agencies specifically, but given SonicWall's own confirmation of active exploitation, every operator running SMA1000 should treat it as an immediate-priority patch rather than a scheduled maintenance item.

Sources: SonicWall product notice, Rapid7, Sophos.