SonicWall SMA1000 CVSS-10 Zero-Day Chain Exploited in the Wild, CISA Orders Rapid Patching
SonicWall has confirmed active exploitation of two SMA1000 vulnerabilities that can be combined to reach unauthenticated remote code execution. CISA has added both flaws to its Known Exploited Vulnerabilities catalog.
Why it matters: Secure remote-access appliances sit directly on enterprise network boundaries; SonicWall says both flaws have been exploited and CISA has placed them in KEV.
Organizations running SonicWall SMA1000 remote-access appliances face an urgent patching issue after the vendor confirmed that two vulnerabilities are being exploited in real-world attacks.
The most severe vulnerability, CVE-2026-83548, carries a CVSS score of 10.0 and is a pre-authentication server-side request-forgery flaw. A second vulnerability, CVE-2026-83549, can allow operating-system command execution. The vulnerabilities can be combined into an attack path providing unauthenticated remote code execution.
CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on September 2. Administrators should identify affected SMA1000 appliances, apply current SonicWall updates and review logs and configuration for evidence of exploitation before patching.
Because exploitation has already been observed, organizations should treat this as an incident-exposure question rather than routine vulnerability management.