6 mincritical
SonicWall SMA1000 vulnerabilities (CVE-2026-83548, CVE-2026-83549) in active exploitation
SonicWall disclosed two vulnerabilities in SMA1000 appliances on September 1, 2026, both confirmed as exploited in the wild. CVE-2026-83548 is a critical unauthenticated SSRF flaw (CVSS 10.0) in the Appliance Work Place interface. CVE-2026-83549 is a high-severity OS command injection vulnerability (CVSS 7.8) in the Appliance Management Console that requires authenticated admin access to achieve remote code execution. Affected models include 6210, 7210, and 8200v.
Sens:■ ImmediateConf:
IOCs2
2cve
Detection / Hunteropenrouter
What Happened
SonicWall has reported two security weaknesses in their SMA1000 remote access devices. The first weakness (CVE-2026-83548) allows an attacker to access sensitive internal functionality without needing a password, and it has the highest possible severity rating. The second weakness (CVE-2026-83549) allows an attacker who already has administrator access to run unauthorized commands on the device. Both weaknesses are being actively used by attackers in the real world. Organizations using affected SonicWall models (6210, 7210, and 8200v) should identify and update these devices immediately.
Key Takeaways
- Two SonicWall SMA1000 vulnerabilities disclosed on September 1, 2026 and confirmed exploited in the wild
- CVE-2026-83548 is a critical unauthenticated SSRF flaw (CVSS 10.0) in the SMA1000 Appliance Work Place interface
- CVE-2026-83549 is a high-severity OS command injection (CVSS 7.8) in the Appliance Management Console requiring authenticated admin access
- Affected models: SMA1000 6210, 7210, and 8200v
- SophosLabs is actively monitoring for related threat activity and will deliver detections as available
Affected Systems
- SonicWall SMA1000 model 6210
- SonicWall SMA1000 model 7210
- SonicWall SMA1000 model 8200v
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-83548 | SonicWall SMA1000 Appliance Work Place interface | Critical (CVSS 10.0) | Unauthenticated server-side request forgery (SSRF) flaw that allows an attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. |
| CVE-2026-83549 | SonicWall SMA1000 Appliance Management Console (AMC) | High (CVSS 7.8) | OS command injection vulnerability arising from improper neutralization of special elements that enables a remote attacker authenticated as an administrator to execute arbitrary OS commands resulting in remote code execution. |
Attack Chain
- Initial Access: Unauthenticated attacker exploits SSRF vulnerability (CVE-2026-83548) in SMA1000 Work Place interface
- Access: Attacker gains unauthorized access to sensitive functionality and performs unauthorized operations on the appliance
- Execution: Authenticated administrator exploits OS command injection (CVE-2026-83549) in Appliance Management Console via improperly neutralized special elements
- Impact: Arbitrary OS command execution results in remote code execution on the SonicWall appliance
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: SophosLabs
SophosLabs is actively monitoring the threat landscape for activity related to these vulnerabilities and will deliver detections and protections as available. No specific rule content is provided in the article.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | SonicWall SMA1000 appliances are network infrastructure devices that typically do not run standard EDR agents. Detection relies on appliance-level logging and network monitoring rather than endpoint telemetry. |
| Network Visibility | Medium | Network monitoring can capture traffic to and from the Work Place interface and AMC. Visibility depends on whether management interfaces are accessible from untrusted networks and whether TLS inspection is applied to appliance management traffic. |
| Detection Difficulty | Moderate | SSRF exploitation attempts against the Work Place interface may be identifiable through appliance access logs. OS command injection through AMC requires monitoring administrative sessions and command patterns. Detection difficulty increases if management interfaces use encrypted connections without inspection. |
Required Log Sources
- SonicWall SMA1000 appliance logs
- SonicWall AMC administrative action logs
- Network firewall logs covering appliance management interfaces
- Web application firewall logs if deployed in front of SMA1000
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Unauthenticated SSRF exploitation attempts targeting the SonicWall SMA1000 Work Place interface may appear as unusual or repeated requests to internal URLs or sensitive endpoints without prior authentication. | SonicWall appliance access logs, reverse proxy logs, WAF logs | Initial Access | Medium — legitimate administrative probes or health checks may generate similar patterns. |
| OS command injection via AMC may manifest as unexpected OS-level commands or processes originating from the AMC service account on the appliance. | SonicWall AMC logs, appliance process logs, system audit logs | Execution | Low to Medium — legitimate administrative operations through AMC should follow known patterns and scheduled maintenance windows. |
| Successful exploitation may result in unexpected outbound network connections from the appliance, indicating SSRF callback or post-exploitation command and control activity. | Network flow data, firewall egress logs, DNS query logs from the appliance | Exfiltration or C2 | Medium — appliances may legitimately initiate outbound connections for firmware updates or telemetry. |
Control Gaps
- EDR coverage does not extend to SonicWall network appliances
- Encrypted management traffic may bypass network-based IDS/IPS if TLS inspection is not deployed
- Legacy or unmanaged SMA1000 appliances may lack centralized logging or alerting
Key Behavioral Indicators
- Unauthenticated HTTP requests to Work Place interface endpoints from external sources
- Administrative sessions to AMC originating from unexpected source IPs or outside normal maintenance windows
- Unusual outbound connections from the SMA1000 appliance to internal or external destinations
- Presence of OS-level command execution patterns in AMC logs that deviate from standard administrative operations
False Positive Assessment
Medium — SSRF and command injection detection on network appliances may overlap with legitimate administrative probes, health checks, or firmware update activity. Tuning detection logic to account for known management workflows is recommended.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting.
- Identify all SonicWall SMA1000 appliances in your environment and confirm whether models 6210, 7210, or 8200v are deployed and running vulnerable firmware
- Apply vendor-supplied firmware upgrades from SonicWall as soon as patches are available, prioritizing internet-exposed appliances first
- Consider restricting network access to the Work Place interface and AMC to trusted management networks only, if supported by your network architecture
Infrastructure Hardening
- Evaluate whether SMA1000 management interfaces can be placed behind a VPN or jump host rather than being directly internet-accessible
- Consider implementing network-level ACLs to limit which IP ranges can reach the AMC on affected appliances
- If a WAF or reverse proxy is deployed in front of SMA1000, consider enabling request filtering for SSRF-related patterns and special character neutralization
User Protection
- Review and reduce the number of accounts with administrative access to the AMC to minimize exposure to CVE-2026-83549
- If MFA is supported for the SMA1000 administrative interface, consider enabling it to reduce the risk of credential compromise leading to command injection
Security Awareness
- Inform network and security operations teams of the active exploitation status so they can prioritize patching and monitoring of affected appliances
- Consider adding SonicWall SMA1000 appliance patching to existing vulnerability management SLAs for critical infrastructure devices
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Initial Access
Tactic
Execution
Showing defanged values
- cveCVE-2026-83548Unauthenticated server-side request forgery (SSRF) flaw that allows an attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
- cveCVE-2026-83549OS command injection vulnerability arising from improper neutralization of special elements that enables a remote attacker authenticated as an administrator to execute arbitrary OS commands resulting in remote code execution.