Critical SonicWall SMA 1000 Flaws Enable Unauthenticated RCE

The exploitation activity follows attacks earlier this summer on two other zero-day vulnerabilities in the vendor's edge devices.

September 2, 2026

Attackers are exploiting two zero-day vulnerabilities affecting select SonicWall SMA 1000 perimeter devices, and customers are urged to patch immediately.

SonicWall disclosed two flaws on Tuesday: pre-authentication server-side request forgery (SSRF) vulnerability CVE-2026-83548 and post-authentication remote code execution (RCE) vulnerability CVE-2026-83549. The former is present in the SMA 1000 Appliance Work Place interface (the user facing portal) and the latter in the SMA 1000 Appliance Management Console (AMC), which is the administrator portal for SMA 1000 remote access gateways.

CVE-2026-83548, the SSRF bug, was designated the maximum CVSS 3.0 score of 10. SonicWall said in its advisory that the vulnerability is caused by an unintended alternate access path. "A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations," the advisory read.

Critical SonicWall SMA 1000 Flaws Enable Unauthenticated RCE

Other newsrooms on this story

Related reading

SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now

SonicWall warns of actively exploited SMA1000 zero-day flaws

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits