Loading story…
SonicWall disclosed active exploitation of two vulnerabilities in SMA1000-series SSL VPN appliances: CVE-2026-83548, a critical pre-authentication server-side request forgery (SSRF) flaw with a CVSS score of 10.0, and CVE-2026-83549, a high-severity post-authentication OS command-injection flaw. The SSRF issue stems from an unintended forward-proxy access path in the Work Place interface and may enable unauthenticated attackers to reach internal resources or potentially execute commands; the command-injection flaw enables authenticated administrators to run arbitrary operating-system commands through the Appliance Management Console.
SonicWall has issued hotfix firmware and urged customers to apply it immediately. Organizations operating affected appliances should restrict access to the Work Place and administrative interfaces, monitor appliances for anomalous outbound connections, and review administrator activity and appliance logs for indicators of compromise.
See which actors are running it and whether you're in range.
13 events from the most recent confirmed update back to the earliest known activity.
CISA added SonicWall SMA1000 vulnerabilities CVE-2026-83548 and CVE-2026-83549 to its Known Exploited Vulnerabilities catalog after SonicWall reported both flaws were being actively exploited.
The Canadian Centre for Cyber Security published advisory AV26-872 concerning active exploitation of CVE-2026-83548 and CVE-2026-83549 in SonicWall SMA1000 appliances. It identified affected SMA1000 6210, 7210, and 8200v devices and urged administrators to apply available updates and review SonicWall guidance.
SonicWall released SMA1000 hotfix firmware versions 12.4.3-03526 and 12.5.0-02952 to address CVE-2026-83548 and CVE-2026-83549, urging customers to upgrade promptly.
SonicWall PSIRT disclosed CVE-2026-83548, a CVSS 10.0 pre-authentication SSRF flaw in the SMA1000 Work Place interface, and CVE-2026-83549, a post-authentication OS command-injection flaw in the Appliance Management Console. PSIRT said its investigation of a case indicated that the vulnerabilities were being actively exploited.
CISA confirmed in August that ransomware gangs were abusing SonicWall SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410, which attackers had exploited in July to install custom malware on VPN appliances.
A Metasploit module, linux/http/sonicwall_sma1000_couchdb_rce, was added for SMA1000-9427. It abuses SonicWall WorkPlace to proxy unauthenticated requests to loopback CouchDB, enables CouchDB's Erlang query server, and demonstrated a root Meterpreter session through ctrl-service and cmsSnmpTrap.sh.
WaterISAC notified affected utilities that the actively exploited CVE-2026-83548 and CVE-2026-83549 chain requires immediate installation of SonicWall hotfix firmware, with no workaround available. It warned that compromise of internet-facing SMA1000 gateways could provide access to internal and potentially OT-supporting environments.
Truesec advised defenders to review SMA1000 syslogs for POST requests to /workplace/ containing URL-encoded internal IP addresses, loopback addresses, or management hostnames, and to investigate Appliance Management Console access originating from the appliance workplace process. It also highlighted suspicious requests involving /workplace/, /appliance/, and 127.0.0.1.
NHS England published an advisory warning that internet-facing edge devices are attractive targets and rapidly exploited. Its National CSOC assessed further exploitation of CVE-2026-83548 and CVE-2026-83549 as almost certain.
SonicWall advised customers to have affected systems reviewed for indicators of compromise. For confirmed compromises, it recommended re-imaging physical SMA1000 appliances or re-deploying virtual appliances, changing user and administrator passwords, and resetting TOTP tokens.
SonicWall said observed exploitation of CVE-2026-83548 and CVE-2026-83549 suggests attackers may be chaining the flaws. The SSRF and command-injection chain can enable unauthenticated remote code execution on affected SMA1000 appliances.
Huntress reported that an attack spree in late July compromised 30 SonicWall customers in less than two days. The report provides a quantified victim impact for the earlier SMA1000 exploitation activity.
More than a month before the newly disclosed flaws, SonicWall fixed SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410. The earlier vulnerabilities were reportedly exploited by UTA0533 to deploy KNUCKLEBALL malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
41 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecert.pa
Open sourcegithub.com
Open sourcehipaajournal.com
Open sourcelabs.beazley.security
Open sourcecve.org
Open sourcepsirt.global.sonicwall.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Aug 25, 2026
SonicWall has released urgent patches for a local privilege escalation vulnerability (CVE-2025-40602) in its Secure Mobile Access (SMA) 1000 appliances, following reports of active exploitation in the wild. Attackers have been chaining this flaw with a previously patched deserialization vulnerability (CVE-2025-23006) to achieve unauthenticated remote code execution with root privileges on affected devices. The vulnerabilities impact the Appliance Management Console (AMC) and Central Management Console (CMC), and SonicWall has advised customers to upgrade to the latest hotfix versions and restrict management interface access to mitigate risk. Security advisories from multiple sources, including government agencies and SonicWall itself, emphasize the criticality of patching due to the widespread use of SMA1000 appliances in large enterprises and critical infrastructure. Over 950 internet-exposed SMA1000 devices have been identified, heightening concerns about potential exploitation. No indicators of compromise have been released, but organizations are urged to apply the fixes immediately and review their exposure to the AMC and SSH interfaces to prevent further attacks.
Jul 23, 2026
SonicWall disclosed four vulnerabilities in **Secure Mobile Access (SMA) 1000** series appliances that could allow **SQL injection-based privilege escalation**, **unauthenticated user credential enumeration**, and **multi-factor authentication bypass**. The issues affect SMA 1000 deployments through flaws in SQL handling and Unicode processing, with the most severe bug tracked as **`CVE-2026-4112`** and rated **CVSS 7.2**. SonicWall said the vulnerabilities do **not** impact SSL-VPN functionality on standard SonicWall firewalls. According to SonicWall's advisory **`SNWLID-2026-0003`**, the Unicode-related flaws can bypass **TOTP** protections in **AMC**, **Workplace**, or **Connect Tunnel** authentication flows, increasing the risk of unauthorized access. SonicWall said it has **no evidence of active exploitation** and provided **hotfixes and fixed releases** for affected SMA 1000 versions, adding that **no workarounds or alternative mitigations are available**, making patching the required response for exposed systems.
Jun 29, 2026