Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

SonicWall SMA1000 command injection flaws (multiple vulnerabilities)

Vulnerability
First reported
Last updated
Happening score
H score 59
3 unique sources, 4 articles

Summary

Hide ▲

SonicWall SMA 1000 appliances are facing active exploitation of CVE-2026-83548 and CVE-2026-83549, a vulnerability chain that can lead to remote code execution on affected devices. The flaws hit SMA 1000 models 6210, 7210, and 8200v and combine a pre-auth SSRF in the Appliance Work Place interface with a post-auth command injection in the Appliance Management Console (AMC). SonicWall released fixes in 12.4.3-03526 and 12.5.0-02952 and urged customers to upgrade, review for indicators of compromise, and re-image appliances or reset passwords and TOTP if compromise is found.

Related Happenings

SonicWall SMA1000 hotfix advisory

Advisory/Mitigation
H score58 First: 02.09.2026 09:39 Last: 02.09.2026 09:39 Sources 1

How related: Fixes have been released in versions 12.4.3-03526 (platform-hotfix) and 12.5.0-02952 (platform-hotfix). SonicWall is recommending that customers perform the actions outlined below -

About this happening: SonicWall has confirmed active exploitation of SMA1000 zero-days and released hotfixes for affected appliances. The attack chain involves CVE-2026-83548 in the A...

Open Happening

SonicWall SMA1000 zero-day exploitation wave (CVE-2026-15409, CVE-2026-15410)

Exploitation Wave
H score24 First: 03.08.2026 13:39 Last: 03.08.2026 13:39 Sources 1

About this happening: SonicWall SMA1000 is in an active exploitation wave involving CVE-2026-15409 and CVE-2026-15410, with unauthenticated access to restricted services and root esca...

Open Happening

INC Ransomware campaign expands across multiple victims

Campaign
H score43 First: 03.08.2026 13:39 Last: 03.08.2026 13:39 Sources 1

About this happening: The INC Ransomware operation has accelerated its SonicWall SMA1000 exploitation and leak-site pressure, expanding impact across multiple victims in several countri...

Open Happening

CISA KEV catalog addition for SonicWall SMA 1000 flaws

Public Sector Action
H score34 First: 15.07.2026 08:30 Last: 15.07.2026 08:30 Sources 1

About this happening: CISA added CVE-2026-15409 and CVE-2026-15410 affecting SonicWall SMA 1000 appliances to the Known Exploited Vulnerabilities (KEV) catalog on July 14, 2026,...

Open Happening

SonicWall SMA1000 SSRF and code injection flaws (multiple vulnerabilities)

Vulnerability
H score48 First: 15.07.2026 00:23 Last: 15.07.2026 00:23 Sources 1

About this happening: SonicWall SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410 were exploited as zero-days against Secure Mobile Access VPN appliances, with SonicWall rel...

Latest development: 03.08.2026 13:39

SonicWall patched CVE-2026-15409 and CVE-2026-15410 on July 14, 2026, and CISA added both flaws to the Known Exploited Vulnerabilities (KEV) catalog the same day after the SMA1000 issues had already been abused in the wild.

Open Happening

Timeline

  1. 03.09.2026 08:19 2 articles · 13d ago

    SonicWall investigates active exploitation of SMA 1000 flaws

    Initial Disclosure

    SonicWall said it investigated a case indicating active exploitation of CVE-2026-83548 and CVE-2026-83549 in SonicWall SMA 1000 Appliances. CVE-2026-83548 is a server-side request forgery flaw that could let a remote unauthenticated attacker gain unauthorized access to sensitive functionality and perform unauthorized operations, while CVE-2026-83549 is a post-authentication operating system command injection flaw that could let a remote authenticated attacker as administrator execute arbitrary OS commands and reach remote code execution.

    Show sources
    Open in new tab
  2. 02.09.2026 09:39 4 articles · 13d ago

    SonicWall warns of actively exploited SMA1000 zero-day command injection chain

    Initial Disclosure

    SonicWall warned that threat actors are chaining CVE-2026-83548 and CVE-2026-83549 against SMA1000 6210, 7210, and 8200v appliances to achieve remote code execution, and said PSIRT has investigated a case indicating active exploitation. The company urged customers to install the latest hotfix version and, if indicators of compromise are found, to re-image appliances, change all user and administrator passwords, and reset TOTP tokens.

    Show sources
    Open in new tab