Summary
| Parameter | Value |
|---|---|
| CVE ID (lead entry) | CVE-2026-83548 |
| Vulnerabilities covered | 2 (CVE-2026-83548, CVE-2026-83549) |
| Alert source | CISA KEV - actively exploited vulnerabilities |
| CVE year | 2026 |
| Publication date | 2026-09-02 |
| Vendor | SonicWall |
| Product | SMA1000 (SMA 6210, SMA 7210, SMA 8200v) |
| Vendor advisory | SNWLID-2026-0016 |
| CVSS Score | 10.0 and 7.8 |
| CISA KEV | Yes — both |
| CISA deadline | 2026-09-05 |
| Ransomware | Not confirmed |
Vulnerability Description
The SonicWall SMA1000 is a secure remote access gateway — the appliance through which employees, partners and service technicians reach an organisation’s internal resources. In advisory SNWLID-2026-0016 the vendor described two vulnerabilities, both already exploited in attacks.
| CVE | Interface | Vulnerability class | Authentication | CVSS |
|---|---|---|---|---|
| CVE-2026-83548 | Work Place | server-side request forgery (SSRF) via an unintended alternate access path | not required | 10.0 |
| CVE-2026-83549 | Appliance Management Console (AMC) | OS command injection | required, as administrator | 7.8 |
CVE-2026-83548 stems from an unintended alternate access path in the Work Place interface. A remote, unauthenticated attacker can use it to reach functionality that was meant to be unavailable externally and to perform unauthorised operations. This is the flaw behind the 10.0 rating — it requires nothing beyond network access to the appliance, and the appliance is by design exposed to the internet.
CVE-2026-83549 is an OS command injection flaw in the AMC management console. It requires authentication as administrator, hence the lower score. The impact is execution of arbitrary operating system commands on the appliance.
Why these two are worth reading together. Separately they look like vulnerabilities of different weight. Together they form a pattern familiar from attacks on edge devices: the first flaw provides a foothold with no credentials at all, the second provides full command execution once credentials are in hand. And administrator credentials for a VPN gateway are not an impassable wall: they get phished, they leak along with other systems, and sometimes they remain at their post-deployment defaults.
Why edge devices in particular. A remote access gateway combines three traits that together make it a first-choice target: it is exposed to the internet, it sees traffic into the internal network, and it is rarely updated, because restarting it drops the sessions of every remote worker. That last trait is operational rather than technical — and it is usually what leaves the patch waiting for weeks.
Required Actions
- Apply the updates from SonicWall advisory SNWLID-2026-0016. It lists the fixed firmware versions for each model.
- Do not defer the restart. Updating an access gateway drops remote users’ sessions and therefore tends to be postponed. With two KEV-listed vulnerabilities, that postponement is a decision to accept risk and should be named as such to management, not buried in the change queue.
- Restrict access to the AMC management console. The gateway’s administrative interface should not be reachable from the internet. Limiting it to a dedicated management network removes the precondition for CVE-2026-83549 regardless of the update.
- Review Work Place interface access logs. Since CVE-2026-83548 works without authentication, traces of an exploitation attempt will be requests to unusual paths, not failed logins.
- Verify the appliance’s administrative accounts. Check for accounts you cannot tie to a specific person, confirm default passwords have been changed, and ensure administrative access is protected by multi-factor authentication.
- Check what is visible from the gateway. If the appliance has been compromised, the attacker’s next step is lateral movement into the internal network. Segmentation on the gateway’s internal side determines how far that movement reaches.
Who Is Affected?
The vulnerabilities affect SonicWall SMA1000 appliances — per the CPE data in NVD, this covers the SMA 6210, SMA 7210 models and the virtual SMA 8200v.
In practice this affects organisations providing employees with remote access to internal resources through a SonicWall gateway. SonicWall is present mainly in the mid-market segment and in branch offices of larger organisations — often deployed and maintained by an external integrator, which is worth accounting for when establishing who is responsible for the update.
Companies whose SMA1000 gateway serves partner or third-party technician access deserve particular attention. Such accounts tend to be watched less closely than employee accounts, and for CVE-2026-83549 credentials are precisely the precondition.
Sources
- NVD - CVE-2026-83548
- NVD - CVE-2026-83549
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-83548
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-83549
- SonicWall PSIRT - SNWLID-2026-0016
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
How many vulnerabilities does this alert cover?
Two, both in SonicWall SMA1000 appliances and both described in the same vendor advisory, SNWLID-2026-0016. CVE-2026-83548 is a server-side request forgery (SSRF) flaw in the Work Place interface, exploitable without authentication, rated 10.0. CVE-2026-83549 is an OS command injection flaw in the AMC management console, requiring authentication as administrator, rated 7.8. Both are in the CISA KEV catalog.
Why cover them together?
Because they affect the same appliance, come from one advisory, and require the same response - updating the same gateway. More importantly, they form a natural chain: the first works before login and reaches functionality that should not be available externally, while the second grants OS command execution to whoever is already logged in as administrator.
What is the SMA1000 and why is it a sensitive device?
The SMA1000 is a secure remote access gateway - the appliance through which employees and partners reach an organisation's internal resources. By definition it sits at the boundary between the public and internal networks, is exposed to the internet, and sees traffic heading into company systems. That makes it a first-choice target, not a device you can dismiss as 'just a VPN'.
Is CVE-2026-83549 really dangerous if it requires authentication?
Yes, despite the lower 7.8 score. It requires administrator credentials, which sounds like a meaningful barrier, but in practice credentials get phished, leak from other systems, or remain at their defaults. The consequence is OS command execution on an edge device - full control over the gateway through which traffic passes into the internal network.
What is the CISA deadline?
5 September 2026 for both vulnerabilities. Presence in the KEV catalog means confirmed exploitation in attacks - and SonicWall edge devices have been targeted by campaigns before, including ransomware ones.
