Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A pre-auth SSRF chained with an OS command injection flaw turns SonicWall's own remote-access gateway into unauthenticated remote code execution, already exploited in the wild.
On September 1, 2026, SonicWall disclosed two vulnerabilities in its SMA1000 series appliances, the Secure Mobile Access gateways many organizations use as the front door for remote-worker VPN access, that were already being exploited in the wild. Individually, the two bugs are bad. Chained together, they add up to unauthenticated remote code execution on a device that, by design, sits exposed to the internet. Rapid7's advisory is the clearest public technical breakdown of how the chain actually works.
CVE-2026-83548 is a critical, pre-authentication server-side request forgery (SSRF) vulnerability, scored a maximum 10.0 on CVSS v3.1, no login required. CVE-2026-83549 is a high-severity OS command injection vulnerability, but on its own it requires authenticated administrator access, which limits its usefulness to an attacker who already has a foothold.
The danger is in the combination: by leveraging the SSRF flaw to reach an internal endpoint an attacker shouldn't be able to touch directly, an attacker can exploit the command injection flaw without ever needing valid credentials in the first place. That turns a "requires admin access" bug into a fully unauthenticated remote code execution chain, the worst-case category for an internet-facing appliance.
The advisory names SMA1000 Models 6210, 7210, and 8200v running firmware versions 12.4.3-03453 (platform-hotfix) or earlier, and 12.5.0-02835 (platform-hotfix) or earlier. SonicWall's fix ships in 12.4.3-03526 and 12.5.0-02952 and later, anything below those hotfix builds is exposed.
This isn't a one-off. Remote-access appliances sit at a structurally difficult position: they have to be reachable from the open internet by definition, they hold or broker credentials for everything behind them, and a flaw in one becomes a flaw in the entire network it was supposed to protect. That's exactly the class of exposure our Penetration Testing and Network Security engagements are built to find before an advisory forces the issue, testing internet-facing infrastructure the way an attacker actually approaches it, not just checking a patch-level report against a CVE feed.
SonicWall's own guidance is direct: apply the updated platform hotfix immediately, and if there's any reason to suspect a device was already exploited, treat it as a real compromise, contact SonicWall support for a review, and where compromise is confirmed, re-image the appliance and reset every password and TOTP token behind it, not just the admin account. Patch level alone doesn't tell you whether an exposed window before the fix was already used; that's a question only an actual investigation answers.
If you're not sure whether your own perimeter has other exposed appliances or services nobody's tracked, our free Domain Footprint Analyzer is a reasonable first pass, and our CVE Lookup tool is a quick way to check a specific product and version against known vulnerabilities like this one. For the broader pattern of how a single infrastructure flaw becomes a full breach, see our piece on vulnerability management and patch prioritization.
Tell us about your environment and goals, we'll help you scope the right engagement.