CVE-2026-83549Vulnerability

SonicWall SMA1000 Appliances OS Command Injection Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 2 Sep 2026.

Reported by 10 independent sources · first reported 2 Sep 2026 by Sophos X-Ops · last reported 13 Oct 2026

Last reported 12 days ago

CISA KEVAdded 2 Sep 2026
Fix due 5 Sep 2026
Used by ransomware: not knownCISA KEV catalogue

EPSS9.9%
higher than 95% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

11 reports, newest first · the exact sentence from each

“CVE-2026-83549”

Recorded FutureVendor13 Oct 2026
September 2026 CVE Landscape
“In early September, SonicWall patched two zero-days (CVE-2026-83548 (CVSS 10.0) and CVE-2026-83549 (CVSS 7.8)) in SMA 1000 VPNs, including a CVSS 10 pre-auth SSRF flaw, after confirming active exploitation.”

Security AffairsNews7 Oct 2026
SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances
“SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 on July 14, and CVE-2026-83548 and CVE-2026-83549 on September 1.”

The Hacker NewsNews7 Oct 2026
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
“… SonicWall reported that threat actors are actively exploiting a chained set of SonicWall SMA1000 zero-day flaws, CVE-2026-83548 and CVE-2026-83549, to run commands on exposed remote access appliances.”

CERT-EUGovernment2 Oct 2026
Cyber Brief 26-10 - September 2026
“CVE reference: CVE-2026-83549”

Rapid7Vendor11 Sep 2026
Metasploit Wrap Up: This One Goes to Sixteen!
“SonicWall has addressed CVE-2026-83548 and CVE-2026-83549, critical vulnerabilities affecting SMA 1000 remote access gateways.”

Check Point ResearchVendor7 Sep 2026
7th September – Threat Intelligence Report
“The two zero-days allow attackers to bypass authentication (CVE-2026-83548) and run malicious commands on the devices (CVE-2026-83549).”

Risky Business NewsNews4 Sep 2026
Risky Bulletin: Russia tells data centers to deploy drone defenses
“Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild”

Rapid7Vendor2 Sep 2026
Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
“The second zero day is CVE-2026-83549: a post-authentication remote code execution (RCE) vulnerability in the SMA1000 Appliance Management Console, which has a CVSS score of 7.8.”

Infosecurity MagazineNews2 Sep 2026
Hackers Chain Two New SonicWall Zero-Day Vulnerabilities
“La vulnérabilité CVE-2026-83549 permet à un attaquant authentifié avec les droits administrateur d'exécuter du code arbitraire à distance.”

CERT-FRGovernment2 Sep 2026
Multiples vulnérabilités dans SonicWall Secure Mobile Access (02 septembre 2026)
“SonicWall SMA1000 vulnerabilities (CVE-2026-83548, CVE-2026-83549) in active exploitation”

Sophos X-OpsVendor2 Sep 2026
SonicWall 83548 83549

Indicators reported together

named in the same reports

Also named with it: CVE-2026-83548, CVE-2026-82329, CVE-2026-87491, CVE-2026-48710, CVE-2026-81578, CVE-2026-82078, CVE-2026-20079, CVE-2026-65660, CVE-2026-19490, CVE-2026-32475, CVE-2026-9586, CVE-2026-49869, CVE-2026-59822, CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258, CVE-2026-60004, CVE-2026-15409, CVE-2026-15410

Thanks — we review every report.

Report a wrong value