# SonicWall SMA 1000 flaws exploited in wild

Published: 2026-09-02 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/6fee6368-620a-5a87-83c3-627bca84a95d/sonicwall-sma-1000-flaws-exploited-in-wild

> SonicWall SMA 1000 devices face active exploitation of an unauthenticated SSRF and an admin-level RCE flaw, per ANSSI/CERT-FR alert.

On 1 September 2026, SonicWall disclosed two vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series appliances (models 6210, 7210, and 8200v), both of which are confirmed to be actively exploited in the wild. CVE-2026-83548 is a critical server-side request forgery (SSRF) flaw exploitable by an unauthenticated attacker. CVE-2026-83549 allows an authenticated attacker with administrative privileges to achieve remote code execution. SonicWall has not clarified whether these two flaws can be chained together to allow a fully unauthenticated attacker to achieve full device compromise, which raises significant concern about the actual attack surface.

Affected versions are SMA 1000 12.5.x prior to 12.5.0-02952 and versions prior to 12.4.3-03526. Notably, CERT-FR emphasizes that patching alone is insufficient to remediate a compromise: SonicWall recommends full system reinstallation, resetting all user and administrator passwords, and reissuing TOTP (time-based one-time password) seeds for affected devices. This guidance strongly suggests that successful exploitation may have led to credential or secret material theft that a simple patch would not resolve.

Indicators of compromise are not publicly published; organizations must contact SonicWall technical support to obtain them, limiting independent verification by the broader defender community. Given the active exploitation status, the SSRF component's lack of authentication requirement, and the vendor's unusually strong remediation guidance (full reinstall plus credential/TOTP reset), affected organizations should treat this as an urgent, high-priority patching and incident-response event.

## Mentioned in this report

- Vulnerabilities: CVE-2026-83548 (KEV), CVE-2026-83549 (KEV)

## Detection guidance (public sample)

### SonicWall SMA 1000 SSRF Exploitation Attempt

ATT&CK: T1190

Detects unauthenticated requests to SonicWall SMA 1000 endpoints exploiting CVE-2026-83548 SSRF vulnerability, characterized by unusual URI patterns and internal resource access attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SonicWall SMA 1000 SSRF Exploitation Attempt
description: Detects HTTP requests to SonicWall SMA 1000 appliances attempting to
  exploit CVE-2026-83548 (unauthenticated SSRF). Targets characteristic SSRF patterns
  including requests to internal IP ranges, localhost, or metadata endpoints via the
  vulnerable endpoint without prior authentication.
tags:
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection:
    DestinationHostname|endswith:
    - sma1000
    - sma1000.local
    RequestUri|contains:
    - 127.0.0.1
    - localhost
    - 169.254.169.254
    - '10.'
    - 172.16.
    - 192.168.
    Status: '200'
  filter_authenticated:
    http_user: '*'
  condition: selection and not filter_authenticated
falsepositives:
- Legitimate admin access from trusted networks with pre-existing sessions
- Network monitoring tools performing authorized SSRF testing
level: high
id: bbced087-d06b-50bc-9ec2-6bc49528dde9
status: experimental
author: Vorant
```

### SonicWall SMA 1000 Administrative RCE via HTTP POST

ATT&CK: T1190

Detects POST requests to SonicWall SMA 1000 appliances with command execution payloads, exploiting CVE-2026-83549 to achieve RCE with administrative context. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SonicWall SMA 1000 Administrative RCE via HTTP POST
description: Detects POST requests to SonicWall SMA 1000 vulnerable endpoints attempting
  to execute code via CVE-2026-83549. Targets request patterns with shell metacharacters,
  script inclusion, or process invocation in POST body to known vulnerable paths.
tags:
- attack.t1190
logsource:
  category: proxy
  product: proxy
detection:
  selection:
    DestinationHostname|endswith:
    - sma1000
    - sma1000.local
    RequestMethod: POST
    RequestUri|contains:
    - /cgi-bin/
    - /admin/
    - /gp/
    RequestBody|contains:
    - '`'
    - $(
    - '|'
    - ;
    - '&&'
    Status: '200'
  filter_legitimate_admin:
    SourceIp|startswith:
    - '10.'
    - 172.16.
    - 192.168.
  condition: selection and not filter_legitimate_admin
falsepositives:
- Legitimate administrative API calls from trusted subnets
- Configuration management tools performing valid appliance updates
level: high
id: 85616536-4b75-556b-b522-9390080c5c17
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6fee6368-620a-5a87-83c3-627bca84a95d/sonicwall-sma-1000-flaws-exploited-in-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup