CVE-2026-83549

What is the SonicWall SMA1000?

The SonicWall Secure Mobile Access (SMA) 1000 series (models 6210, 7210, and the virtual 8200v) is an enterprise SSL-VPN/remote-access appliance. Its Appliance Management Console (AMC) is the administrative interface where the device is configured — code execution there means root control of a gateway that terminates VPN sessions and holds directory service credentials for an entire organization.

Overview

CVE-2026-83549 is an OS command injection (CWE-78) in the SMA1000 AMC: an authenticated administrator — or an unauthenticated attacker who reaches AMC functionality via the companion SSRF CVE-2026-83548 — can execute arbitrary OS commands on the appliance. Both flaws were zero-days exploited in the wild as a chain before SonicWall's 2026-09-01 advisory, and both entered the CISA KEV catalog on 2026-09-02 with an accelerated 2026-09-05 deadline. The modest standalone CVSS (7.8, local/authenticated) understates it: in the observed attacks this is the code-execution stage of an unauthenticated remote chain.

Affected Versions

SMA 100 series appliances and SonicWall firewalls are not affected.

Technical Details

The AMC fails to properly neutralize special elements in input that reaches OS command construction (CWE-78), allowing arbitrary command execution with the privileges of the appliance's administrative context. Standalone prerequisites are an authenticated admin session with AMC access — but the in-the-wild attacks removed that requirement by first exploiting the pre-auth WorkPlace SSRF (CVE-2026-83548) to reach AMC functionality, producing an end-to-end unauthenticated RCE chain against internet-facing appliances.

Discovery

Discovered by SonicWall's William Perry and Adam Babis alongside the SSRF; SonicWall itself identified the active exploitation, making both CVEs zero-days at disclosure.

Exploitation Context

Confirmed active exploitation as part of the SSRF-to-command-injection chain (see CVE-2026-83548 for the full picture). No threat actor has been named and attack-start timing was not disclosed. ~420 SMA1000 appliances are internet-reachable per Shadowserver. A successful chain gives the attacker root on a perimeter VPN gateway — historically the precursor to credential theft, lateral movement, and ransomware deployment on this device class.

Remediation

1. Apply the platform hotfix: 12.4.3-03526 or 12.5.0-02952 depending on branch (fixes both chained CVEs). Federal deadline: 2026-09-05.
2. Treat exposed unpatched appliances as potentially compromised: review AMC logs for unexpected admin sessions, configuration changes, and command execution artifacts; engage SonicWall support for IoC guidance.
3. On confirmed or suspected compromise, rebuild the appliance firmware and reset every credential it touches — local admins, bound LDAP/AD service accounts, user sessions, and certificates.
4. Isolate AMC management access on a dedicated management network, unreachable from user-facing interfaces or the internet.
5. Track SonicWall PSIRT advisories for this platform — the SMA1000 has now had actively exploited zero-days in consecutive years.