Pre-auth SSRF chained to unauthenticated remote code execution on SonicWall SMA1000 VPN appliances (CVE-2026-83548)
SonicWall published fixes on September 1 for two SMA1000 zero-days that credible outlets and the Canadian Cyber Centre report are being chained in live attacks, so an unpatched appliance is exposed to unauthenticated remote code execution right now.
A pre-authentication SSRF in the SMA1000 Work Place interface (CVE-2026-83548, CVSS 10.0) gives a remote unauthenticated attacker access to sensitive functionality, and it is being chained with sibling flaw CVE-2026-83549 to achieve unauthenticated remote code execution on the appliance. SMA1000 6210, 7210, and 8200v devices running 12.4.3-03453 (platform-hotfix) and older or 12.5.0-02835 (platform-hotfix) and older are affected.
Affected: SonicWall SMA1000 (6210, 7210, 8200v) 12.4.3-03453 (platform-hotfix) and older; SonicWall SMA1000 (6210, 7210, 8200v) 12.5.0-02835 (platform-hotfix) and older
How to Test
Check the appliance firmware version: any SMA1000 running 12.4.3-03453 (platform-hotfix) or older, or 12.5.0-02835 (platform-hotfix) or older, is vulnerable. Review appliance logs for unexpected or anomalous requests to the Work Place interface from unauthenticated sources, and treat any exposed, unpatched device as potentially compromised given zero-day exploitation preceded the fix.
How to Patch
Apply the security updates SonicWall released under advisory SNWLID-2026-0016, upgrading beyond the affected 12.4.3-03453 and 12.5.0-02835 platform-hotfix builds on all SMA1000 6210, 7210, and 8200v units; if a device cannot be updated immediately, restrict internet access to the Work Place interface until it is patched.