SonicWall SMA1000: Two Zero-Days Exploited Now

What has happened

On 2 September 2026, SonicWall confirmed that two vulnerabilities in its SMA1000 secure remote access appliances are being actively exploited by attackers right now. The flaws – CVE-2026-83548 and CVE-2026-83549 – can be chained together to give an attacker complete, unauthenticated control over an affected device without needing a username or password. CISA, the US Cybersecurity and Infrastructure Security Agency, added both to its Known Exploited Vulnerabilities catalogue the same day.

If your business uses a SonicWall SMA1000 appliance for remote working or VPN access, this needs your attention today.

About the vulnerabilities

SonicWall SMA1000 (Secure Mobile Access) is a popular remote access gateway used by thousands of organisations worldwide, including many UK SMBs, to let employees connect securely from home or on the road. It is a separate product from the SonicWall firewall range and from the smaller SMA 100 series. If you are unsure which devices you have on your network, your IT team or provider should be able to confirm.

The two new flaws work like this:

• CVE-2026-83548 (CVSS 10.0 – the maximum possible severity score) is a server-side request forgery vulnerability in the Appliance Work Place interface. It allows an unauthenticated attacker – someone with no account on your system – to abuse the appliance and trick it into making requests on their behalf. In practice, this is used as the first step to bypass authentication entirely.
• CVE-2026-83549 (CVSS 7.8) is an OS command injection flaw in the Appliance Management Console. Chained with the first vulnerability, an attacker can use it to execute arbitrary commands on the device, giving them full control, the ability to harvest credentials, and a foothold into your internal network.

When used together, the attack chain requires no valid credentials at all. An attacker can go from zero access to owning the device in a single sequence of requests. This is as serious as remote vulnerabilities get.

Why this matters to your business

Remote access appliances sit at the very edge of your network. Compromising one gives attackers a trusted foothold inside your perimeter – from there, they can move laterally to file servers, access email, steal credentials, or deploy ransomware. This exact attack pattern has been used in numerous recent ransomware incidents against UK businesses.

The fact that these were zero-days – meaning they were being exploited before a patch existed – and that SonicWall has now released fixes within days of disclosure, underlines how quickly threat actors move when they find a high-value target. For UK SMBs, the urgency is the same whether or not CISA mandates apply to you.

Affected models and the fix

The vulnerabilities affect SonicWall SMA1000 models 6210, 7210, and 8200v running firmware version 12.4.3-03453 / 12.5.0-02835 or earlier. The SMA 100 series and SonicWall firewall SSL-VPN are not affected by these specific CVEs.

SonicWall has released patched firmware:

• Version 12.4.3-03526
• Version 12.5.0-02952

If you are running an affected appliance, upgrade to one of these versions immediately. Do not wait for a scheduled maintenance window.

What you should do right now

1. Find out if you have a SonicWall SMA1000. It may be managed by your IT team, your MSP, or have been installed by a previous supplier. Check your network edge devices and any remote access portals your staff use.
2. Check the firmware version. Log in to the management console and compare your current version against the affected versions above.
3. Apply the patch without delay. Upgrade to firmware 12.4.3-03526 or 12.5.0-02952. Do not wait.
4. Review recent remote access logs. Look for unexpected authentication attempts, unfamiliar session origins, or unusual outbound connections from the appliance over the past few weeks.
5. If you are unsure whether you are affected, contact your IT support provider for an urgent check.

What System Force does for clients

We actively track vulnerability disclosures across our clients’ environments and push patches for managed devices as quickly as possible. For clients running Fortinet edge devices – which we manage and support – we apply security updates on a priority basis whenever actively exploited vulnerabilities are disclosed. The same monitoring approach applies to any device within a managed support contract.

If you have remote access infrastructure that is not currently under a managed support agreement, or you have inherited equipment from a previous provider that has not been reviewed in a while, now is a good moment to get that picture clear. Our IT security services include a review of your network perimeter, and our managed IT support covers ongoing patch management so you are not left exposed between updates.

Keeping perimeter devices patched and monitored is one of the most effective things any business can do to reduce its cyber risk – and it is something your IT support provider should be handling for you as a matter of course, not something you should have to chase.

If you would like us to check your remote access configuration or discuss how we manage security for our clients, get in touch or call 01452 701355 for a no-obligation chat. You can also reach us via our contact page.