SonicWall confirmed on September 1, 2026 that two vulnerabilities in its SMA1000 series remote access appliances are being actively exploited, and one of them needs no username or password at all. If your business uses an SMA1000 to give employees VPN access into the office network, check your firmware version today. The CISA Known Exploited Vulnerabilities catalog added both flaws on September 9, 2026, which means real attacks were already happening before most IT teams had even read the advisory.
- CVE-2026-83548 is a critical, unauthenticated SSRF flaw in the SMA1000 Work Place interface, rated 10.0 out of 10 for severity.
- CVE-2026-83549 is a high-severity OS command injection bug in the Appliance Management Console.
- Chained together, the two flaws let an attacker with zero credentials run commands on the appliance.
- Vulnerable firmware: 12.4.3-03453 and earlier, and 12.5.0-02835 and earlier.
- This is the second internet-facing remote access appliance under active attack this year, after the Citrix NetScaler vulnerability earlier in 2026.
What exactly is broken in the SMA1000?
The first bug, CVE-2026-83548, is a server-side request forgery flaw in the part of the appliance that end users log into for VPN access. An attacker who reaches that interface, no account needed, can trick the appliance into making requests on their behalf and reach functionality that should be locked down. The second bug, CVE-2026-83549, is a command injection flaw in the administrative console. SonicWall’s own advisory and independent analysis from Rapid7 both describe the two flaws being chained to achieve remote code execution without any prior access to the box.
Is my business actually affected?
You are affected if you run a SonicWall SMA1000 appliance for remote employee access and it is reachable from the public internet, which is how these devices are meant to work. Firmware 12.4.3-03453 and earlier, or 12.5.0-02835 and earlier, is vulnerable. Log into the Appliance Management Console and check the version under System status. If you are not sure whether your company runs an SMA1000 versus a different SonicWall model, your MSP or whoever manages your firewall should be able to confirm it in a few minutes.
What should I do this week?
Patch to SonicWall’s fixed firmware first. If you cannot patch immediately because of a maintenance window or a vendor dependency, restrict access to the Work Place portal and the Appliance Management Console to known office or home IP ranges instead of leaving them open to any address on the internet. Pull authentication and access logs and look for logins or requests from locations your employees do not work from. Rotate admin credentials on the appliance once it is patched, since a compromised box before the fix may have exposed them.
Why do VPN appliances keep making headlines?
Remote access appliances sit at the edge of the network by design, reachable from anywhere so employees can log in from home or the road. That same design makes them the first thing attackers scan for. The Citrix NetScaler bug earlier this year worked the same way: one flaw in an internet-facing login portal gave attackers a path straight to the internal network. When one of these boxes is running old firmware, it is not a hidden risk. It is often the single most exposed system a small business owns.
Frequently asked questions
What is the SonicWall SMA1000 vulnerability?
It is a pair of flaws, CVE-2026-83548 and CVE-2026-83549, in SonicWall’s SMA1000 remote access appliances. The first lets an attacker reach internal systems with no login at all. Chained with the second, it can lead to full remote code execution on the appliance.
How do I check if my SonicWall firmware is affected?
Log into the Appliance Management Console and check the firmware version under System > Status. Firmware 12.4.3-03453 and earlier, or 12.5.0-02835 and earlier, needs to be patched to SonicWall’s fixed release right away.
Is my business too small for attackers to bother with?
No. These attacks are largely automated. Scanners look for any internet-facing SMA1000 login page regardless of company size, and a small business with an unpatched appliance is just as reachable as a large one.
What if I can’t patch the appliance right away?
Restrict access to the Work Place portal and Appliance Management Console to known IP ranges, disable any unused remote access features, and review authentication logs for logins from unfamiliar locations until the patch is applied.
An unpatched remote access appliance sitting on the open internet is exactly the kind of gap that turns into a full network compromise, and it is often invisible until someone goes looking for it. If you are not sure whether your VPN or remote access setup is exposed, or you want a second set of eyes on your firewall and Microsoft 365 configuration, Boston Managed IT offers a free 15-minute review. Call (617) 322-5155 or visit bostonmit.com/contact to set one up.
— Boston Managed IT
