SonicWall SMA1000 flaws exploited in wild
CERT-FR warns two actively exploited SonicWall SMA1000 vulnerabilities allow remote code execution and SSRF.
CERT-FR has issued an advisory covering multiple vulnerabilities in SonicWall SMA1000 series appliances (models 6210, 7210, and 8200v). The flaws enable remote arbitrary code execution and server-side request forgery (SSRF). Affected versions include 12.5.x builds prior to 12.5.0-02952 and versions prior to 12.4.3-03526.
SonicWall's own security bulletin (SNWLID-2026-0016) confirms that CVE-2026-83548 and CVE-2026-83549 are being actively exploited in the wild, elevating the urgency for administrators managing affected Secure Mobile Access appliances. CERT-FR directs organizations to SonicWall's advisory for patch information.
Given the active exploitation status and the remote code execution impact on internet-facing secure remote access infrastructure, affected organizations should prioritize patching to the fixed versions immediately and review SMA1000 access logs for signs of compromise.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1103
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free