ZeroDay Findings
Sign inSign up

Findings

CVE-2026-83549

SonicWall SMA1000 Appliances OS Command Injection Vulnerability

Published Sep 1, 2026 · updated Sep 21, 2026 · SonicWall SMA1000 Appliances

Overview On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549 , can be chained to achieve unauthenticated remote code execution (RCE) on affected appliances. CVE-2026-83548 is a critical pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. The flaw has a CVSS v3.1 base score of 10.0 and can allow a remote, unauthenticated attacker to access sensitive functionality and p

Timeline

Detection, updates, and resolution for this record.

  1. Sep 1, 2026 · Catalog

    Detected

    Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

  2. Sep 2, 2026 · CISA KEV

    Known exploited

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

  3. Sep 5, 2026 · CISA KEV

    Remediation due

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

  4. Sep 21, 2026 · Catalog

    Updated

    Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA due date Sep 5, 2026

Affected

  • cpe sonicwall/sma6210 firmwareversion unspecified
  • cpe sonicwall/sma7210 firmwareversion unspecified
  • cpe sonicwall/sma8200vversion unspecified
  • vendor SonicWall SMA1000 Appliancesversion unspecified

Sources

  • CISA KEVCVE-2026-83549

    SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

    cisa.gov
  • CVE.orgCVE-2026-83549

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-83549

    30-day exploitation probability 9.9%

    first.org
  • Metasploit Modulesexploit_linux/http/sonicwall_sma1000_couchdb_rce

    Public module reference (great). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2026-83549

    Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker

    nvd.nist.gov
  • Rapid7 Vulnerability DatabaseCVE-2026-83549

    Overview On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549 , can be chained to achieve unauthenticated remote code execution (RCE) on affected appliances. CVE-2026-83548 is a critical pre-authentication server-side request forgery

    rapid7.com

References

CVE-2026-83549 · ZeroDay Findings