Security company SonicWall has advised its customers to urgently patch two newly disclosed vulnerabilities affecting its Secure Mobile Access (SMA) 1000 appliances, after confirming that they are both being actively exploited in the wild.
SMA1000 is an enterprise platform that protects remote access to corporate applications and resources on premises, in the cloud and in hybrid IT environments.
In a security notice published on Sep. 1, SonicWall stated that the vulnerabilities affect SMA 6210, SMA 7210 and SMA 8200v appliances running vulnerable versions of its 12.4.3 or 12.5.0 firmware. SSL-VPN services running on SonicWall firewalls and the SMA 100 Series are not affected.
The more severe vulnerability, tracked as CVE-2026-83548, received a maximum CVSS severity score of 10.0. It is a pre-authentication Server-Side Request Forgery (SSRF) flaw in the WorkPlace interface of SMA1000 appliances.
Attackers exploiting this vulnerability could prompt a vulnerable server to send requests to unintended systems or locations. According to SonicWall, the exploitation of CVE-2026-83548 could allow an unauthenticated threat actor to “gain unauthorized access to sensitive functionality and perform unauthorized operations”.
The second vulnerability, tracked as CVE-2026-83549, is an OS command-injection flaw in the Appliance Management Console that was assigned a high-severity CVSS score of 7.8.
SonicWall explained that under specific conditions, it could allow a remote authenticated attacker with administrator privileges to execute arbitrary operating system commands, resulting in Remote Code Execution (RCE).
The company also said that the two flaws are being chained together, with the pre-authentication SSRF providing the access needed to reach the management console. That removes the authentication requirement entirely.
Patching the flaws and checking for compromise
In its security notice, SonicWall confirmed that both vulnerabilities are being actively exploited, yet did not disclose details about any observed attacks, affected organizations, or whether the attackers responsible were identified.
The company said it discovered both the flaws and their exploitation internally, and neither has been added to CISA’s KEV catalog at the time of writing.
SonicWall urged organizations that rely on affected appliances to upgrade to firmware version 12.4.3-03526 or 12.5.0-02952. It also advised customers to contact its Technical Support team to check for any signs of compromise.
If the support team detects signs of compromise, SonicWall recommends re-imaging physical appliances or redeploying virtual ones, changing all user and administrator passwords, and resetting Time-based One-Time Password (TOTP) tokens.
