Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

SonicWall SMA1000 hotfix advisory

Advisory/Mitigation
First reported
Last updated
Happening score
H score 58
3 unique sources, 3 articles

Summary

Hide ▲

SonicWall has confirmed active exploitation of SMA1000 zero-days and released hotfixes for affected appliances. The attack chain involves CVE-2026-83548 in the Appliance WorkPlace interface and CVE-2026-83549 in the Appliance Management Console, enabling remote code execution on SMA 1000 models 6210, 7210, and 8200v. SonicWall says the fixes are available in 12.4.3-03526 and 12.5.0-02952, and advises customers to upgrade immediately and check for indicators of compromise. If compromise is found, SonicWall recommends re-imaging, changing all user and administrator passwords, and resetting TOTP tokens.

Related Happenings

SonicWall SMA1000 command injection flaws (multiple vulnerabilities)

Vulnerability
H score59 First: 02.09.2026 09:39 Last: 02.09.2026 09:39 Sources 1

How related: The second zero day is CVE-2026-83549: a post-authentication remote code execution (RCE) vulnerability in the SMA1000 Appliance Management Console, which has a CVSS score of 7.8.

About this happening: SonicWall SMA 1000 appliances are facing active exploitation of CVE-2026-83548 and CVE-2026-83549, a vulnerability chain that can lead to remote code execution...

Latest development: 03.09.2026 08:19

SonicWall said it investigated a case indicating active exploitation of CVE-2026-83548 and CVE-2026-83549 in SonicWall SMA 1000 Appliances. CVE-2026-83548 is a server-side request forgery flaw that could let a remote unauthenticated attacker gain unauthorized access to sensitive functionality and perform unauthorized operations, while CVE-2026-83549 is a post-authentication operating system command injection flaw that could let a remote authenticated attacker as administrator execute arbitrary OS commands and reach remote code execution.

Open Happening

PaperCut emergency patches for public-facing NG/MF servers

Security Patch Release
H score51 First: 27.08.2026 19:31 Last: 27.08.2026 19:31 Sources 1

About this happening: PaperCut says bad actors are actively exploiting a zero-day affecting PaperCut NG and PaperCut MF, with impact reported across all versions of the prin...

Latest development: 01.09.2026 10:48

Attackers are abusing CVE-2026-81578 and CVE-2026-82078 against vulnerable PaperCut NG/MF print management servers to steal data, with Defused observing exploit activity in honeypots since late yesterday UTC (Aug 29th) and reporting an auth bypass used to hijack PaperCut's external user-lookup and dump DB tables via Derby.

Open Happening

SonicWall SMA1000 zero-day exploitation wave (CVE-2026-15409, CVE-2026-15410)

Exploitation Wave
H score24 First: 03.08.2026 13:39 Last: 03.08.2026 13:39 Sources 1

About this happening: SonicWall SMA1000 is in an active exploitation wave involving CVE-2026-15409 and CVE-2026-15410, with unauthenticated access to restricted services and root esca...

Open Happening

INC Ransomware campaign expands across multiple victims

Campaign
H score43 First: 03.08.2026 13:39 Last: 03.08.2026 13:39 Sources 1

About this happening: The INC Ransomware operation has accelerated its SonicWall SMA1000 exploitation and leak-site pressure, expanding impact across multiple victims in several countri...

Open Happening

CISA KEV catalog addition for SonicWall SMA 1000 flaws

Public Sector Action
H score34 First: 15.07.2026 08:30 Last: 15.07.2026 08:30 Sources 1

About this happening: CISA added CVE-2026-15409 and CVE-2026-15410 affecting SonicWall SMA 1000 appliances to the Known Exploited Vulnerabilities (KEV) catalog on July 14, 2026,...

Open Happening

Timeline

  1. 02.09.2026 09:39 1 articles · 13d ago

    SonicWall confirms active exploitation of chained SMA1000 zero-days

    Initial Disclosure

    SonicWall said threat actors are chaining CVE-2026-83548, a maximum-severity command injection flaw in the SMA1000 Appliance WorkPlace interface stemming from an SSRF weakness, with CVE-2026-83549 in the SMA1000 Appliance Management Console to achieve remote code execution on SMA1000 6210, 7210, and 8200v devices.

    Show sources
    Open in new tab
  2. 02.09.2026 09:39 4 articles · 13d ago

    SonicWall urges SMA1000 customers to install the latest hotfix

    Mitigation Patch Update

    SonicWall urged customers to upgrade virtual or physical SMA1000 appliances to the latest hotfix version and advised re-imaging appliances, changing all user and administrator passwords, and resetting TOTP tokens if indicators of compromise are detected.

    Show sources
    Open in new tab