SonicWall released emergency hotfixes addressing two zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 series enterprise gateway appliances. Tracked as CVE-2026-83548 (CVSS 10.0) and CVE-2026-83549 (CVSS 7.8), the flaws impact physical and virtual 6210, 7210, and 8200v models running firmware versions 12.4.3-03453, 12.5.0-02835, and earlier. CVE-2026-83548 is a pre-authentication Server-Side Request Forgery (SSRF) flaw in the internet-facing Appliance Work Place interface arising from an alternate access path. Threat actors weaponized this primitive to reach the internal Appliance Management Console (AMC) and trigger CVE-2026-83549, a post-authentication OS command injection flaw, thereby achieving full remote code execution with root privileges without valid credentials.

SonicWall confirmed active in-the-wild exploitation of the chain, prompting CISA to add both vulnerabilities to the Known Exploited Vulnerabilities catalog. Remediation requires deploying hotfix versions 12.4.3-03526 or 12.5.0-02952. Because threat actors gain persistent host-level access beneath device inspection layers, SonicWall advises organizations with detected compromises to completely re-image appliances, reset administrative credentials, and revoke Time-based One-Time Password seeds.

Why it matters:

• Perimeter exploit chaining: By routing pre-authentication SSRF directly into administrative interfaces, adversaries bypass perimeter boundaries and execute arbitrary commands on edge gateway appliances without external authentication.
• Critical remediation mandate: Edge appliances lack endpoint detection agents, making host compromise difficult to observe; administrators must apply hotfixes immediately, inspect management logs for unauthorized access, and cycle all secrets.