GoKawiilSonicWall discloses two zero-day flaws in SMA1000 under active attack
SonicWall has warned that attackers are chaining two newly discovered vulnerabilities in its SMA1000 secure remote access appliances to execute code remotely. One flaw is a maximum-severity command injection issue in the WorkPlace interface caused by an SSRF weakness, while the second lets an authenticated admin run arbitrary OS commands via the Management Console. The bugs affect the SMA1000 6210, 7210, and 8200v models, with over 400 exposed devices currently visible online.
GoKawiil's interpretation of the reporting above, not reported fact.
SMA1000 devices are widely deployed by large enterprises, government agencies, and critical infrastructure operators to provide secure remote access, making them a high-value target for attackers seeking initial network entry. This marks the second SMA1000 zero-day chain disclosed this year, following similar attacks in July, suggesting sustained interest from threat actors in exploiting SonicWall's remote access products.
- Two zero-days (CVE-2026-83548 and CVE-2026-83549) are being actively chained against SonicWall SMA1000 appliances.
- Only the 6210, 7210, and 8200v models are affected; SMA 100 and firewall SSL-VPN products are not impacted.
- SonicWall urges immediate hotfix upgrades, password resets, and re-imaging if compromise indicators are found.
YubiKey 5 NFC Security Key — When VPN appliances get chained zero-days, hardware-backed MFA is one of the strongest ways to keep admin access from being trivially reused. The YubiKey 5 NFC works with FIDO2/WebAuthn, OTP and smart card logins across most enterprise and personal accounts, and taps to phones over NFC. It's a simple, phishing-resistant layer to add while you're patching everything else.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-02
Published there as: “SonicWall warns of actively exploited SMA1000 zero-day flaws”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.