CVE Tools
Track your stack

SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE

Dark ReadingBy Alexander Culafi

Reported exploitedSonicWall SMA 1000

Our summary

Attackers are actively exploiting two zero-day vulnerabilities in specific SonicWall SMA 1000 models, allowing for unauthenticated remote code execution when the flaws are chained together. The issues include a critical pre-authentication server-side request forgery vulnerability (CVE-2026-83548, CVSS 10.0) and a post-authentication OS command injection flaw (CVE-2026-83549, CVSS 7.8).

SonicWall advises customers running versions 12.4.3-03453 or 12.5.0-02835 on models 6210, 7210, and 8200v to immediately update to firmware versions 12.4.3-03526 or 12.5.0-02952. Organizations should also monitor for indicators of compromise and consider reimaging or redeploying appliances if breaches are detected.

Read at Dark Reading

Dark Reading publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsAttackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack ChainCVE-2026-15409, CVE-2026-15410 +2
  2. Help Net SecuritySonicWall SMA 1000 appliances under attack via zero-day flawsCVE-2026-15409, CVE-2026-15410 +2
  3. BleepingComputerSonicWall warns of actively exploited SMA1000 zero-day flawsCVE-2026-15409, CVE-2026-15410 +2
  4. BleepingComputerInfraTrust report warns network management systems under attackCVE-2026-83548, CVE-2026-83549
  5. Check Point Research7th September – Threat Intelligence ReportCVE-2026-83548, CVE-2026-83549
  6. Help Net SecurityWeek in review: Claude accounts compromised through infostealer, Patch Tuesday forecastCVE-2026-83548, CVE-2026-83549
  7. The Hacker NewsCISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto MinersCVE-2026-83548, CVE-2026-83549
  8. SecurityWeekSonicWall Warns of Two SMA1000 Zero-Days Exploited in AttacksCVE-2026-83548, CVE-2026-83549
  9. BleepingComputerCISA: SonicWall SMA1000 flaws now exploited by ransomware gangsCVE-2026-15409, CVE-2026-15410
  10. The Hacker NewsINC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 FlawsCVE-2026-15409, CVE-2026-15410

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store