SonicWall SMA 1000 flaws exploited in wild
SonicWall SMA 1000 devices face active exploitation of an unauthenticated SSRF and an admin-level RCE flaw, per ANSSI/CERT-FR alert.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-83548 and CVE-2026-83549 as exploited in the wild.
On 1 September 2026, SonicWall disclosed two vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series appliances (models 6210, 7210, and 8200v), both of which are confirmed to be actively exploited in the wild. CVE-2026-83548 is a critical server-side request forgery (SSRF) flaw exploitable by an unauthenticated attacker. CVE-2026-83549 allows an authenticated attacker with administrative privileges to achieve remote code execution. SonicWall has not clarified whether these two flaws can be chained together to allow a fully unauthenticated attacker to achieve full device compromise, which raises significant concern about the actual attack surface.
Affected versions are SMA 1000 12.5.x prior to 12.5.0-02952 and versions prior to 12.4.3-03526. Notably, CERT-FR emphasizes that patching alone is insufficient to remediate a compromise: SonicWall recommends full system reinstallation, resetting all user and administrator passwords, and reissuing TOTP (time-based one-time password) seeds for affected devices. This guidance strongly suggests that successful exploitation may have led to credential or secret material theft that a simple patch would not resolve.
Indicators of compromise are not publicly published; organizations must contact SonicWall technical support to obtain them, limiting independent verification by the broader defender community. Given the active exploitation status, the SSRF component's lack of authentication requirement, and the vendor's unusually strong remediation guidance (full reinstall plus credential/TOTP reset), affected organizations should treat this as an urgent, high-priority patching and incident-response event.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs