SonicWall Patches Two 0-Days in SMA 1000: Attackers Chain the Flaws Together

SonicWall has released security updates for its Secure Mobile Access (SMA) 1000 series remote access appliances, fixing two vulnerabilities that were already being used in zero-day attacks. Both flaws were discovered by the company's in-house specialists — William Perry and Adam Babis.

Two vulnerabilities — one chain

The first, CVE-2026-83548, with a maximum CVSS score of 10.0, is an unauthenticated SSRF vulnerability in the Appliance Work Place interface. It allows a remote attacker without credentials to gain access to sensitive device functions and carry out unauthorized operations.

The second, CVE-2026-83549 (rated 7.8), is an operating system command injection in the Appliance Management Console. It can be exploited by an already authenticated user with administrator privileges, which under certain conditions leads to remote code execution.

According to SonicWall, an investigation into one of the incidents indicates that the attackers chained both flaws together: the first opens the door, and the second allows arbitrary code to be executed on the vulnerable device.

Who is affected and what to do

The issue affects the SMA 1000 6210, 7210 and 8200v models running versions 12.4.3-03453 and 12.5.0-02835 and earlier. The fixes shipped in builds 12.4.3-03526 and 12.5.0-02952.

SonicWall recommends not stopping at simply installing the patch. In addition to updating to the latest version, the company advises checking systems for indicators of compromise and, if any are found, reinstalling or redeploying the appliances from scratch, changing all user and administrator passwords, and resetting the TOTP one-time codes.

The company did not disclose details about the nature of the attacks or who is behind them. The incident came just over a month after SonicWall closed two other vulnerabilities in the same product — CVE-2026-15409 and CVE-2026-15410. They were used by a group designated UTA0533 to deploy the KNUCKLEBALL malware. A string of holes in a single device family over such a short period makes the SMA 1000 gateways an attractive target and one more reason not to put off updating.

Source: The Hacker News