New zero-day vulnerabilities discovered in SonicWall SMA1000 devices
Critical security flaws in remote access gateways are being actively exploited by attackers.
1Critical security vulnerabilities identified
SonicWall has detected two chained zero-day vulnerabilities in its SMA1000 series security appliances. The first vulnerability, tracked as CVE-2026-83548, is a pre-authentication server-side request forgery (SSRF) flaw with a maximum CVSS v3 score of 10.0. The second vulnerability, CVE-2026-83549, allows post-authentication OS command injection and is rated 7.8. These flaws affect SMA 6210, 7210, and 8200v devices, prompting immediate action from administrators.
2Valuable target for attackers
SMA1000 gateways are used by mid-sized and large enterprises to secure remote access and VPN connections. Compromising these devices provides attackers with a valuable entry point into corporate networks. SonicWall recommends applying hotfixes immediately as there are no available workarounds. The company advises customers to contact technical support to identify potential compromise indicators and take necessary remediation steps.
3NHS England issues warning
NHS England has published an advisory highlighting the growing risk of attacks against internet-facing gateways. The organization stated, 'Firewalls and other edge devices are internet-facing by design and highly attractive targets for attackers.' The NHS England National CSOC assesses the likelihood of future exploitation of these vulnerabilities as 'almost certain,' noting an increasing number of edge device vulnerabilities being rapidly exploited each year.
4Previously used in ransomware campaigns
A similar pair of vulnerabilities disclosed by SonicWall in 2025 was later added to CISA's Known Exploited Vulnerabilities catalog and confirmed to have been used in ransomware campaigns. Tracked as CVE-2026-15409, these flaws also involved SSRF and command injection in SMA1000 series devices. Throughout 2025, SonicWall patched multiple SMA1000 vulnerabilities while investigating zero-days linked to ransomware attacks.
5Urgent measures for affected devices
SonicWall recommends reimaging or redeploying potentially compromised appliances, changing all passwords, and resetting TOTP tokens. The company has released hotfixes for SMA 6210, 7210, and 8200v devices, emphasizing the critical need for immediate patching. Customers are urged to contact technical support for assistance in identifying compromise indicators and implementing appropriate security measures.
6CVSS scores indicate severity
CVE-2026-83548 received the maximum CVSS v3 score of 10.0, indicating critical severity. SonicWall described this vulnerability as resulting from an 'unintended alternative access path.' An unauthenticated remote attacker could exploit this flaw to gain unauthorized access to sensitive functionality. CVE-2026-83549, rated 7.8, requires administrator authentication under specific conditions for exploitation.
7Challenging year for SonicWall
2025 proved difficult for SonicWall regarding its SMA1000 product line security issues. In July 2025, the company disclosed another eerily similar pair of vulnerabilities: a pre-authentication SSRF flaw in the SMA1000 Appliance WorkPlace interface and a post-authentication OS command injection vulnerability in the AMC. The SSRF flaw also scored 10.0 on the CVSS scale. Throughout 2025, SonicWall addressed various SMA1000 vulnerabilities including command injection and privilege escalation flaws.
8Critical warning for enterprise security
The active exploitation of these vulnerabilities demands immediate action from mid-sized and large enterprises. SMA1000 series devices serve as critical remote access points to corporate networks, making these flaws potentially devastating if exploited. NHS England's warning underscores the expanding attack surface presented by internet-facing edge devices. Organizations must prioritize patch application and enhance their breach detection capabilities to mitigate these growing threats.