DaystoPatch

SonicWallExploited incident

SonicWall SMA1000 pre-auth SSRF chained with AMC command injection

CVE-2026-83548, CVE-2026-83549Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 2 Sep 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
0h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    SonicWall PSIRT SNWLID-2026-0016 (PSIRT API record)CuratedQuote verified

    SonicWall PSIRT has investigated a case indicating the active exploitation of the vulnerabilities described in this advisory.

    Bugs and exploitation were found internally (credits: 'Internally discovered by William Perry and Adam Babis of SonicWall'); the advisory, published 2026-09-01T05:43:57Z per the same record, is the first public signal found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b3e210cb18493676…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    SonicWall advisory SNWLID-2026-0016ClaimedQuote verified1 Sep 2026, 05:43 UTC

    1) CVE-2026-83548 - Pre-authentication SSRF via unintended forward-proxy

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6bc3015917664089…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet1 Sep 2026, 20:54 UTC

    CVE-2026-83548 & CVE-2026-83549

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-83548ClaimedQuote verified1 Sep 2026, 21:25 UTC

    A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d262d4dc5d3fc2f1…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet1 Sep 2026, 22:07 UTC

    CVE-2026-83548, a critical SonicWall SMA1000 vulnerability, is exploited in the wild. The pre-authentication SSRF flaw scores a maximum 10.0 CVSS. # SonicWall # SMA1000 # CVE202683548

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-83548)ClaimedQuote verified2 Sep 2026

    SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

    Added to CISA's KEV catalog on 2026-09-02.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-83549)ClaimedQuote verified2 Sep 2026

    SonicWall SMA1000 Appliances OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2026-09-02.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    SonicWall advisory SNWLID-2026-0016ClaimedQuote verified

    1) CVE-2026-83548 - Pre-authentication SSRF via unintended forward-proxy

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6bc3015917664089…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    SonicWall PSIRT SNWLID-2026-0016 (PSIRT API record)CuratedQuote verified1 Sep 2026, 05:43 UTC

    "published_when":"2026-09-01T05:43:57Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b3e210cb18493676…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    SonicWall PSIRT SNWLID-2026-0016 (PSIRT API record)CuratedQuote verified

    12.4.3-03526 (platform-hotfix) and higher versions.

    Fixed hotfixes were in the advisory at publication: the record's last_updated_when equals published_when and its revision history has only 'Initial Release' (01-Sep-2026). Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b3e210cb18493676…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    SonicWall PSIRT SNWLID-2026-0016 (PSIRT API record)CuratedQuote verified

    12.5.0-02952 (platform-hotfix) and higher versions.

    Both affected branches (12.4.3 and 12.5.0) had platform hotfixes at publication.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b3e210cb18493676…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

SonicWall SMA1000 flaw pair exploited, hotfixes released Sep 1

SonicWall found attackers chaining two SMA1000 flaws to run commands on the appliance and published hotfixes the same day it disclosed them, 1 September 2026.

In plain words

SonicWall's SMA1000 remote access appliance had two flaws that attackers were combining to take control of the device. SonicWall disclosed them and released fixes on 1 September 2026. If we use an SMA1000, we need to install the hotfix and have it checked for signs of compromise; if anything is found, the appliance must be rebuilt and all passwords reset.

What happened and who is affected

What happened

On 1 September 2026 SonicWall disclosed CVE-2026-83548, a pre-authentication server-side request forgery in the SMA1000 Work Place interface (CVSS 10.0), and CVE-2026-83549, an OS command injection in the Appliance Management Console. SonicWall said it had investigated a case of active exploitation; researchers note the two can be chained for unauthenticated remote code execution. Platform hotfixes were released with the advisory.

Who is affected

SonicWall SMA1000 appliances (6210, 7210, 8200v; physical and virtual) on 12.4.3-03453 or older and 12.5.0-02835 or older. SMA 100 and firewall SSL-VPN are not affected.

CVE-2026-83548, CVE-2026-83549. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/sonicwall-cve-2026-83548/

Affected products

  • SMA1000 (6210, 7210, 8200v)
How we built this timeline

One advisory (SNWLID-2026-0016) covering both CVEs; both KEV 2 Sep 2026. Exploitation and bugs were found internally by SonicWall and acknowledged in the first publication, so exploited before a fix is true although fixes shipped at the same moment.

The advisory states 'workaround: None.' The human-readable advisory page is a JavaScript app; the PSIRT JSON API it loads is cited instead. CVSS: 10.0 for CVE-2026-83548, 7.8 for CVE-2026-83549.

Wayback was offline during research, so earlier versions of the record could not be checked; the record's own last_updated_when equals published_when. T1 check (23 Oct 2026): SMA1000 release notes are JavaScript-only; no earlier release date for 12.4.3-03526 / 12.5.0-02952 was found.

The previous hotfixes (12.4.3-03453 / 12.5.0-02835, July 2026) are listed as affected, so no older build contains the fix; exploited before a fix stays true.

Related

SonicWall report card