SonicWall SMA1000: CVSS 10 SSRF chained to pre-auth RCE

SonicWall disclosed two vulnerabilities in its SMA 1000 secure remote access appliances on September 1 and said both are already being exploited in the wild. CISA added them to the Known Exploited Vulnerabilities catalog by September 3. If you have an SMA 1000 terminating VPN traffic for your team, the SonicWall SMA1000 pre-auth RCE chain is a same-day job — and patching alone is not the whole job.

What actually happened

Per SonicWall's product notice SNWLID-2026-0016, there are two bugs:

• CVE-2026-83548 — a pre-authentication server-side request forgery in the Work Place interface, scored CVSS 10.0. The appliance can be turned into an unintended forward proxy into its own internal functions.
• CVE-2026-83549 — post-authentication OS command injection in the Appliance Management Console, scored CVSS 7.8 on its own.

The 7.8 is the number people will skim past, and it is the one that matters. Rapid7's analysis is direct about the chain: the command injection normally requires admin credentials, but the SSRF lets an attacker reach the management console as if it were local. Chained, an unauthenticated attacker on the internet runs OS commands on the appliance.

Affected models are the 6210, 7210, and 8200v (all hypervisors) on firmware 12.4.3-03453 and 12.5.0-02835. Fixed builds are 12.4.3-03526 and 12.5.0-02952, available through MySonicWall.

The part of the advisory worth reading twice is the remediation guidance. SonicWall does not say "patch and move on." It says contact support to review the appliance for indicators of compromise, and if compromised: re-image or redeploy the appliance, change every user and administrator password, and reset all TOTP tokens.

Why this matters for your business

A VPN appliance is the one box on your network that is supposed to be reachable from the internet. That is its function, and that is why it is the target. It also holds or brokers the credentials for everything behind it — which is exactly why the vendor's own guidance jumps straight to full credential rotation instead of a patch note.

Three things, in order:

Patch tonight, not in the next maintenance window. These have been exploited since before disclosure. The window closed a week ago.

Assume the credentials are gone if you were on a vulnerable build with the Work Place interface exposed. Rotating passwords and TOTP seeds after the fact is annoying. Discovering six weeks from now that an attacker has valid MFA-enrolled accounts is worse. A patched appliance with an attacker's session still valid is not a fixed appliance.

Then ask why the management console was reachable at all. The SSRF worked because the appliance could talk to its own admin interface. Your version of that question is whether your firewall, NAS, hypervisor, and RMM consoles are reachable from anywhere other than a jump host. Most small networks were built by adding a rule and never removing it.

We keep writing this post with a different vendor name on it — PaperCut, N-able, Kestra. The pattern is stable: the appliance you bought for security becomes the way in, because it is the only thing you deliberately exposed.

Sources: SonicWall product notice SNWLID-2026-0016, Rapid7.