# SonicWall SMA1000 flaws exploited for RCE

Published: 2026-09-02 · Severity: severe · Sectors: government-national, technology
Canonical: https://vorant.io/reports/80329c68-3162-5968-a613-147f3a5978e4/sonicwall-sma1000-flaws-exploited-for-rce

> Two chained vulnerabilities in SonicWall SMA1000 SSL VPN appliances are being actively exploited in the wild to achieve remote code execution.

MS-ISAC has issued an advisory covering two vulnerabilities in SonicWall SMA1000 Series appliances, which serve as enterprise secure access and SSL VPN gateways. CVE-2026-83548 is a pre-authentication SSRF flaw in the Work Place interface caused by an unintended alternate access path, allowing an unauthenticated remote attacker to reach sensitive functionality. CVE-2026-83549 is a post-authentication OS command injection vulnerability in the Appliance Management Console (AMC) that permits an authenticated administrator-level attacker to execute arbitrary OS commands. SonicWall PSIRT has confirmed active exploitation of both CVEs in the wild, and chaining them together can lead to full remote code execution and system compromise.

Affected versions include 12.4.3-03453 (platform-hotfix) and older, and 12.5.0-02835 (platform-hotfix) and older. Given confirmed in-the-wild exploitation of an unauthenticated SSRF combined with a command injection flaw on internet-facing VPN gateways, organizations running SMA1000 appliances should treat this as an urgent patching priority. Recommended mitigations include immediate patching after testing, network segmentation to isolate management interfaces, least-privilege enforcement, vulnerability scanning, and exploit protection measures.

## Mentioned in this report

- Vulnerabilities: CVE-2026-83548 (KEV), CVE-2026-83549 (KEV)

## Detection guidance (public sample)

### SonicWall SMA1000 Unauthenticated SSRF via Alternate Access Path

ATT&CK: T1190

Detects HTTP requests to SonicWall SMA1000 Work Place interface bypassing authentication via unintended alternate access paths, typical of CVE-2026-83548 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SonicWall SMA1000 Unauthenticated SSRF via Alternate Access Path
description: Detects unauthenticated HTTP requests to SonicWall SMA1000 Work Place
  interface using alternate access paths to reach sensitive functions, characteristic
  of CVE-2026-83548 pre-auth SSRF exploitation.
tags:
- attack.t1190
logsource:
  category: proxy
  product: network
detection:
  selection:
    DestinationHostname|endswith:
    - .sma1000
    - sma1000.local
    DestinationPort: 443
    RequestUri|contains:
    - /ws/
    - /webui/
    - /api/
    HttpMethod: GET
    HttpStatusCode: 200
  filter_authenticated:
    HttpHeaders|contains:
    - Authorization
    - Cookie
  condition: selection and not filter_authenticated
falsepositives:
- Legitimate administrative access without explicit session headers in proxy logs
level: high
id: 2be2699f-7db1-53e4-9738-e9f4b2dd589d
status: experimental
author: Vorant
```

### SonicWall SMA1000 AMC OS Command Injection

ATT&CK: T1190

Detects HTTP POST requests to SonicWall SMA1000 Appliance Management Console with command injection payloads in request parameters, indicative of CVE-2026-83549 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SonicWall SMA1000 AMC OS Command Injection
description: Detects HTTP POST requests to SonicWall SMA1000 Appliance Management
  Console containing shell metacharacters or command injection patterns in parameters,
  characteristic of CVE-2026-83549 post-auth RCE.
tags:
- attack.t1190
logsource:
  category: proxy
  product: network
detection:
  selection:
    DestinationHostname|endswith:
    - .sma1000
    - sma1000.local
    DestinationPort: 443
    RequestUri|contains:
    - /admin/
    - /appliance/
    - /management/
    HttpMethod: POST
  injection_patterns:
    RequestBody|contains:
    - $(\
    - '`\'
    - '|'
    - ;
    - '&'
    - '||'
    - '&&'
  condition: selection and injection_patterns
falsepositives:
- Legitimate administrative scripts containing pipe or semicolon in benign parameters
level: high
id: 1dffdae1-aca8-523e-b812-26aa65e21810
status: experimental
author: Vorant
```

### SonicWall SMA1000 SSRF-to-RCE Chain Exploitation

ATT&CK: T1190

Detects sequential HTTP requests combining unauthenticated Work Place interface access followed by post-auth command injection to AMC within short timeframe, indicating chained CVE-2026-83548 and CVE-2026-83549 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SonicWall SMA1000 SSRF-to-RCE Chain Exploitation
description: Detects correlated sequence of unauthenticated SSRF probe on Work Place
  interface followed by authenticated command injection on AMC console within 5 minutes,
  characteristic of combined CVE-2026-83548 and CVE-2026-83549 exploitation chain.
tags:
- attack.t1190
logsource:
  category: proxy
  product: network
detection:
  ssrf_probe:
    DestinationHostname|endswith:
    - .sma1000
    - sma1000.local
    DestinationPort: 443
    RequestUri|contains:
    - /ws/
    - /webui/
    HttpMethod: GET
    HttpStatusCode: 200
  rce_attempt:
    DestinationHostname|endswith:
    - .sma1000
    - sma1000.local
    DestinationPort: 443
    RequestUri|contains:
    - /admin/
    - /management/
    HttpMethod: POST
    RequestBody|contains:
    - $(
    - '`'
    - '|'
    - ;
  condition: ssrf_probe and rce_attempt
falsepositives:
- Separate administrative and diagnostic sessions from different tools on the same
  appliance
level: critical
id: 74361c4c-a0e5-5ea5-a830-46d3b12662a3
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sma1000-series-appliances-could-allow-for-remote-code-execution_2026-087

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/80329c68-3162-5968-a613-147f3a5978e4/sonicwall-sma1000-flaws-exploited-for-rce.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup