Sonicwall - GoKawiil

SonicWall SMA 1000 Devices Hit by Two Actively Exploited Zero-Days

SonicWall disclosed two vulnerabilities in its SMA 1000 series appliances: a maximum-severity SSRF flaw (CVE-2026-83548) in the user-facing Work Place portal and an OS command injection bug (CVE-2026-83549) in the admin console. SonicWall's security team confirmed active exploitation in the wild and urged customers to patch immediately, while researchers at Rapid7 noted the two bugs can be chained together for unauthenticated remote code execution.

darkreading.com · 2026-09-02

SonicWall discloses two zero-day flaws in SMA1000 under active attack

SonicWall has warned that attackers are chaining two newly discovered vulnerabilities in its SMA1000 secure remote access appliances to execute code remotely. One flaw is a maximum-severity command injection issue in the WorkPlace interface caused by an SSRF weakness, while the second lets an authenticated admin run arbitrary OS commands via the Management Console. The bugs affect the SMA1000 6210, 7210, and 8200v models, with over 400 exposed devices currently visible online.

bleepingcomputer.com · 2026-09-02