Last Updated: 2026-09-04T12:29:00Z
CVSSv3: 10.0, 7.8 respectively
What’s Happening
SonicWall disclosed two critical vulnerabilities in its SMA1000 devices on 2026-09-01T07:00:00Z. At the time of disclosure, they were reported exploited in the wild.
The first, CVE-2026-83548, is a Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to perform internal network requests through the SonicWall devices.
CVE-2026-83549 is an authenticated command injection vulnerability. So while not a complete attack chain, the SSRF could lead to information disclosure that allows remote login as an authenticated administrator, and then the command injection vulnerability allows full control over the device.
Actions
Patch the affected versions.
| Affected | Patched |
|---|---|
| 12.4.3-03453 (all versions) | 12.4.3-03526 |
| 12.5.0-02835 (all versions) | 12.5.0-02952 |
Also, don’t put admin interfaces on the web.
Notes
No observables as yet, and we don’t actually know what “exploitation” means in this context, IMO, it’s pretty rarefied to be able to pivot from SSRF to authentication as an administrator of an edge device.
We’ll update this with any observables reported.
SonicWall SMA1000s have had a rough summer, with a preauth deserialization RCE just a month ago.
