3 SEP 2026 — SonicWall has disclosed two zero-day flaws in its SMA1000 remote-access appliances that attackers are already chaining to run code on the device. The vulnerable versions are the builds that fixed the last pair. Every organisation that patched SMA1000 on CISA's three-day clock in July is now running the firmware this advisory names.
What is known
CVE-2026-83548 is a pre-authentication server-side request forgery in the Appliance Work Place interface, rated CVSS 10.0, allowing an unauthenticated attacker to reach sensitive functionality. CVE-2026-83549 is an operating-system command injection in the Appliance Management Console, rated 7.8, allowing an administrator-authenticated attacker to run arbitrary commands.
SonicWall says it has observed exploitation of both, and reporting on the advisory describes the two being chained to execute code on the appliance. Models 6210, 7210 and 8200v are affected. Versions 12.4.3-03453 and older, and 12.5.0-02835 and older, are vulnerable; the fixes are platform hotfixes 12.4.3-03526 and 12.5.0-02952.
SonicWall has not published indicators of compromise or named an actor. As of the advisory, neither identifier had been added to the United States Known Exploited Vulnerabilities catalogue, which already lists seventeen other SonicWall flaws.
The patch is the vulnerable version
In June and July, two SMA1000 flaws were exploited as zero-days by the group tracked as UTA0533, which deployed malware called KNUCKLEBALL. CVE-2026-15409 was a CVSS 10.0 server-side request forgery in the Workplace interface. CVE-2026-15410 was a post-authentication code injection in the Management Console, rated 7.2. CISA gave federal agencies until 17 July to remediate, and the fixed builds were 12.4.3-03453 and 12.5.0-02835.
Read the new advisory's version table against that. The builds SonicWall shipped in July as the remedy are the highest versions the September advisory calls vulnerable.
A later flaw in a patched build is ordinary. But it changes what a defender should conclude. Anyone who treated July's patch as closing the SMA1000 question has been running an appliance under active exploitation since, and the July remediation record is not evidence of current safety.
Same two components, same two bug classes
The correspondence goes further than the version numbers. Both pairs consist of a pre-authentication server-side request forgery in the user-facing Workplace component, scored 10.0, and a command or code injection in the administrative console reachable once authenticated.
Two independently discovered pairs with that structure in ten weeks say more about the codebase than about either bug. The Workplace interface is exposed to the internet by design, and it has now twice let an unauthenticated request be reissued from inside the appliance's own trust boundary.
We wrote in August that patching SMA1000 within the deadline might not have been enough. The concern in July was credentials taken before the patch. The concern now is that the appliance class itself keeps producing the same door.
What patching does not undo
The most useful part of the advisory is also the part least likely to be actioned. Where compromise is found, SonicWall says to re-image the appliance, reset all passwords and reset TOTP tokens.
The third item is the heavy one. Resetting time-based one-time password tokens invalidates the shared secret every enrolled user's authenticator app holds, so every user has to re-enrol. That is a helpdesk event across the whole remote-access population, and it is the step organisations quietly skip once the appliance is back up and traffic is moving.
Skipping it leaves the second factor in the attacker's hands. A seed captured from a compromised gateway keeps generating valid codes indefinitely; the code is a function of the seed and the clock and nothing else. Rotating the password without rotating the seed fixes only the easier half.
Absence from the catalogue is not reassurance
The Known Exploited Vulnerabilities catalogue is a federal instrument. Adding an entry starts a remediation deadline for United States agencies, and since earlier this year that deadline has commonly been three days rather than three weeks.
These two identifiers were not in KEV at disclosure. That reflects CISA's process and evidence threshold, not a judgement about the risk, and the vendor has already said it observed exploitation. An organisation waiting for a KEV listing to justify emergency change control is waiting on a signal designed for somebody else's compliance obligation.
We traced how that three-day deadline became the default earlier this year. The relevant point here is the ordering: the vendor advisory came first, and the catalogue may or may not follow.
The question this raises about the appliance
Remote-access gateways sit at the perimeter, terminate authentication and hold session material for everyone who uses them, which makes them worth more to an attacker than almost anything behind them. That is the trade every organisation makes when it deploys one.
Two exploited pre-authentication chains in the same component within a quarter is a reasonable trigger for asking whether this appliance is still the right side of that trade. The calculation will differ by organisation, and for many the migration cost exceeds the residual risk.
The narrower decision is available to everyone. The Appliance Management Console does not need to be reachable from the internet for the product to do its job, and the second half of both chains lives there. Restrict administrative access to a management network and the escalation step goes away, even when the first flaw returns. On this record, it will.
View author profile → · Editorial policy
