Yaroslav Nechayev
2 min read

Two SonicWall SMA1000 bugs chain into unauthenticated RCE — and they're already being exploited

securityvulnerabilitiesnetworking

On 1 September, SonicWall published advisory SNWLID-2026-0016 covering two flaws in its SMA 1000 remote-access appliances, and confirmed both are "being actively exploited in the wild."

What the two bugs are

CVE-2026-83548 — CVSS 10.0. SonicWall describes it as a pre-authentication SSRF "via unintended forward-proxy." Server-side request forgery means you can make the appliance issue HTTP requests on your behalf, to destinations it can reach and you can't. No credentials needed.

CVE-2026-83549 — CVSS 7.8. SonicWall labels this post-authentication remote code execution in the Appliance Management Console; CISA's KEV entry categorises it as OS command injection. Those descriptions are consistent — command injection is the mechanism, code execution the outcome.

Neither is catastrophic alone. A post-auth RCE needs credentials; a CVSS 10.0 SSRF is bad but isn't execution by itself. Chained, the SSRF supplies what the RCE was missing, and the pair becomes unauthenticated remote code execution on a box that sits at your network edge by design. That's the part worth internalising: severity scores are assigned per-bug, and attackers don't attack per-bug.

What to do

Affected firmware is 12.4.3-03453 and earlier and 12.5.0-02835 and earlier, on SMA 1000 series 6210, 7210, and 8200v. Fixed hotfixes are 12.4.3-03526 and 12.5.0-02952.

SonicWall offers no interim workaround — there's no config toggle to buy time. Patch, or take it off the internet.

Both CVEs went into CISA's KEV catalog on 2 September with a remediation due date of 5 September. That date has passed. If you run these appliances and haven't patched, you're past the deadline US federal agencies were held to, on a device that is actively being exploited.

The catch

Patching is not the end of it. SonicWall's guidance is that if you find indicators of compromise, upgrading is insufficient: re-image the appliance, rotate every password, and reset TOTP tokens. That's the correct advice for any device where an attacker may have achieved code execution — you cannot patch your way out of an already-established foothold, and a remote-access gateway holds exactly the credentials worth stealing.

Rapid7 reported no public proof-of-concept at the time of their writing. That is not reassurance. Exploitation was confirmed before a PoC was public, which means whoever is using this didn't need one.

If you don't run SonicWall, the transferable lesson is the boring one: edge appliances are the least-patched, most-exposed things most organisations own, precisely because they're appliances — someone else's software, on a box nobody owns in the org chart. Go find out who patches yours.

Sources: