SonicWall SMA1000 flaws exploited for RCE
Two chained vulnerabilities in SonicWall SMA1000 SSL VPN appliances are being actively exploited in the wild to achieve remote code execution.
MS-ISAC has issued an advisory covering two vulnerabilities in SonicWall SMA1000 Series appliances, which serve as enterprise secure access and SSL VPN gateways. CVE-2026-83548 is a pre-authentication SSRF flaw in the Work Place interface caused by an unintended alternate access path, allowing an unauthenticated remote attacker to reach sensitive functionality. CVE-2026-83549 is a post-authentication OS command injection vulnerability in the Appliance Management Console (AMC) that permits an authenticated administrator-level attacker to execute arbitrary OS commands. SonicWall PSIRT has confirmed active exploitation of both CVEs in the wild, and chaining them together can lead to full remote code execution and system compromise.
Affected versions include 12.4.3-03453 (platform-hotfix) and older, and 12.5.0-02835 (platform-hotfix) and older. Given confirmed in-the-wild exploitation of an unauthenticated SSRF combined with a command injection flaw on internet-facing VPN gateways, organizations running SMA1000 appliances should treat this as an urgent patching priority. Recommended mitigations include immediate patching after testing, network segmentation to isolate management interfaces, least-privilege enforcement, vulnerability scanning, and exploit protection measures.
Mentioned in this report
Detection guidance
SonicWall SMA1000 Unauthenticated SSRF via Alternate Access Path
Detects HTTP requests to SonicWall SMA1000 Work Place interface bypassing authentication via unintended alternate access paths, typical of CVE-2026-83548 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SonicWall SMA1000 Unauthenticated SSRF via Alternate Access Path
description: Detects unauthenticated HTTP requests to SonicWall SMA1000 Work Place
interface using alternate access paths to reach sensitive functions, characteristic
of CVE-2026-83548 pre-auth SSRF exploitation.
tags:
- attack.t1190
logsource:
category: proxy
product: network
detection:
selection:
DestinationHostname|endswith:
- .sma1000
- sma1000.local
DestinationPort: 443
RequestUri|contains:
- /ws/
- /webui/
- /api/
HttpMethod: GET
HttpStatusCode: 200
filter_authenticated:
HttpHeaders|contains:
- Authorization
- Cookie
condition: selection and not filter_authenticated
falsepositives:
- Legitimate administrative access without explicit session headers in proxy logs
level: high
id: 2be2699f-7db1-53e4-9738-e9f4b2dd589d
status: experimental
author: Vorant
SonicWall SMA1000 AMC OS Command Injection
Detects HTTP POST requests to SonicWall SMA1000 Appliance Management Console with command injection payloads in request parameters, indicative of CVE-2026-83549 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SonicWall SMA1000 AMC OS Command Injection
description: Detects HTTP POST requests to SonicWall SMA1000 Appliance Management
Console containing shell metacharacters or command injection patterns in parameters,
characteristic of CVE-2026-83549 post-auth RCE.
tags:
- attack.t1190
logsource:
category: proxy
product: network
detection:
selection:
DestinationHostname|endswith:
- .sma1000
- sma1000.local
DestinationPort: 443
RequestUri|contains:
- /admin/
- /appliance/
- /management/
HttpMethod: POST
injection_patterns:
RequestBody|contains:
- $(\
- '`\'
- '|'
- ;
- '&'
- '||'
- '&&'
condition: selection and injection_patterns
falsepositives:
- Legitimate administrative scripts containing pipe or semicolon in benign parameters
level: high
id: 1dffdae1-aca8-523e-b812-26aa65e21810
status: experimental
author: Vorant
SonicWall SMA1000 SSRF-to-RCE Chain Exploitation
Detects sequential HTTP requests combining unauthenticated Work Place interface access followed by post-auth command injection to AMC within short timeframe, indicating chained CVE-2026-83548 and CVE-2026-83549 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SonicWall SMA1000 SSRF-to-RCE Chain Exploitation
description: Detects correlated sequence of unauthenticated SSRF probe on Work Place
interface followed by authenticated command injection on AMC console within 5 minutes,
characteristic of combined CVE-2026-83548 and CVE-2026-83549 exploitation chain.
tags:
- attack.t1190
logsource:
category: proxy
product: network
detection:
ssrf_probe:
DestinationHostname|endswith:
- .sma1000
- sma1000.local
DestinationPort: 443
RequestUri|contains:
- /ws/
- /webui/
HttpMethod: GET
HttpStatusCode: 200
rce_attempt:
DestinationHostname|endswith:
- .sma1000
- sma1000.local
DestinationPort: 443
RequestUri|contains:
- /admin/
- /management/
HttpMethod: POST
RequestBody|contains:
- $(
- '`'
- '|'
- ;
condition: ssrf_probe and rce_attempt
falsepositives:
- Separate administrative and diagnostic sessions from different tools on the same
appliance
level: critical
id: 74361c4c-a0e5-5ea5-a830-46d3b12662a3
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sma1000-series-appliances-could-allow-for-remote-code-execution_2026-087
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free