SonicWall SMA 1000 Zero-Day Chain Exploited in Remote Code Execution Attacks
SonicWall has alerted administrators to active zero-day exploitation targeting its SMA 1000 series remote access appliances. Threat actors are chaining two distinct vulnerabilities to achieve remote code execution from an unauthenticated posture. The initial access vector leverages `CVE-2026-83548`, a maximum-severity (CVSS 10.0) pre-authentication server-side request forgery (SSRF) flaw in the SMA 1000 Appliance WorkPlace interface caused by an alternate access path. Attackers then pair this with `CVE-2026-83549`, a post-authentication OS command injection issue carrying a CVSS score of 7.8 located within the Appliance Management Console (AMC). When chained, an unauthenticated attacker can manipulate internal functionality to execute arbitrary operating system commands with administrative privileges on the target device. The vulnerable hardware and virtual models include the SMA 1000 series 6210, 7210, and 8200v running firmware versions `12.4.3-03453`, `12.5.0-02835`, or earlier releases. SonicWall confirmed that SonicWall firewalls with SSL-VPN enabled and the SMA 100 series product line remain unaffected by these vulnerabilities. Remediation requires deploying hotfix versions `12.4.3-03526` and `12.5.0-02952` or upgrading to higher releases immediately. According to data from Shadowserver, more than 400 SMA 1000 appliances remain publicly exposed to the internet. If indicators of compromise are discovered, the vendor instructs administrators to completely re-image physical units or redeploy virtual instances, rotate all user and administrator credentials, and reset TOTP tokens.
Read more about SonicWall SMA 1000 Zero-Day Chain Exploited in Remote Code Execution Attacks