Exploitation observed; activity peaked at 41 mentions and remains active
Immediate actions
Patch sonicwall sma6210 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-05. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Active Exploitation20Disclosure2Exploit1General1Patch1
2026-09-04
15
Active Exploitation9Disclosure1General2Patch2PoC1
2026-09-05
5
Active Exploitation5
2026-09-06
2
Active Exploitation1Patch1
2026-09-07
6
Active Exploitation2Exploit1Patch3
2026-09-08
6
Active Exploitation5Exploit1
2026-09-09
3
Active Exploitation2Disclosure1
2026-09-10
1
Active Exploitation1
2026-09-11
1
Active Exploitation1
2026-09-13
1
Patch1
2026-09-15
1
Active Exploitation1
2026-09-16
2
Active Exploitation2
2026-09-17
3
Active Exploitation3
2026-09-18
1
Active Exploitation1
2026-09-23
2
Active Exploitation1Disclosure1
>Full discourse20 posts
Stephen Fewer@stephenfewer·
Exploit
Just added a @metasploit exploit for last weeks SonicWall SMA1000 zero-day chain that has been exploited in-the-wild (CVE-2026-83548 + SMA1000-9427 + CVE-2026-83549). It a 3 bug chain; an SSRF to CouchDB read/write for low priv RCE, to root RCE via command injection in cmsSnmpTrap. https://github.com/rapid7/metasploit-framework/pull/21883
Post summary
The tweet announces a new Metasploit module for the SonicWall SMA1000 zero‑day chain, confirms the CVE is actively exploited in the wild, and outlines the SSRF‑to‑RCE attack chain.
🚨 CRITICAL: CVE-2026-83548 is a maximum-severity SonicWall SMA1000 vulnerability with a CVSS score of 10.0.
The pre-authentication SSRF flaw can be exploited remotely by an unauthenticated attacker, potentially allowing requests to be sent to unintended internal or external resources.
⚠️ The vulnerability is being actively exploited in the wild. Organizations using affected SMA1000 appliances should patch immediately and investigate for signs of compromise.
🔗 http://psirt.global.sonicwall.com/vuln-detail/…
#SonicWall#SMA1000#CVE#SSRF#CyberSecurity#Infosec
Post summary
CVE-2026-83548 is a critical SSRF vulnerability in SonicWall SMA1000 reportedly actively exploited in the wild; affected organizations should patch immediately and investigate for signs of compromise.
🚨 CRITICAL ZERO-DAY ALERT: SonicWall SMA 1000 Remote Access Gateways Under Active Exploitation in the Wild (CVE-2026-83548 & CVE-2026-83549) If you run SonicWall SMA 1000 appliances (SMA 6210, 7210, 8200v), your enterprise perimeter is at immediate risk of unauthenticated Remote Code Execution (RCE).Here is the complete operational briefing, identification guide, mitigation blueprint, and detection rules.
1. WHAT IS THIS THREAT?Threat actors are chaining two actively exploited zero-days to achieve unauthenticated root-level RCE on internet-facing SSL-VPN gateways: CVE-2026-83548 (CVSS 10.0 - Critical): A pre-authentication Server-Side Request Forgery (SSRF) flaw in the Appliance WorkPlace interface. It exposes an unintended forward proxy path (/wsproxy), enabling attackers without credentials to spoof client headers and tunnel HTTP requests directly into internal localhost services. CVE-2026-83549 (CVSS 7.8 - High): An OS Command Injection flaw in the Appliance Management Console (AMC). The Attack Chain: Attackers exploit the pre-auth SSRF to reach the administrative AMC endpoint internally, satisfy authentication requirements, and trigger command injection to execute arbitrary shell commands with root privileges.
2. HOW TO IDENTIFY IF YOU ARE COMPROMISEDBecause SMA appliances broker VPN sessions, credentials, and MFA seeds, attackers leverage RCE to harvest credentials and drop webshells. Inspect edge telemetry for: WorkPlace Access Logs: Look for anomalous HTTP POST/GET requests targeting /wsproxy with atypical User-Agent strings or internal IP forward targets (127.0.0.1, localhost, AMC ports).AMC Authentication Anomalies: Inspect administrative login records for admin sessions originating from 127.0.0.1, unusual high ports, or non-working hours.Outbound C2 Beacons: Network flow logs showing unexpected egress TCP traffic (direct IP outbound connections) originating from the SMA management interface.Process & Cron Anomalies: Presence of unauthorized background listeners (e.g., nc, bash -i, python/perl sockets) or modified crontabs in /etc/cron* or /var/spool/cron/.
3. MITIGATION & REMEDIATIONThere is no temporary workaround. Immediate action is required: Apply Emergency Hotfixes: Upgrade immediately to firmware:12.4.3-03526 (or later) for the 12.4 branch 12.5.0-02952 (or later) for the 12.5 branch Isolate Management Portals: Ensure the Appliance Management Console (AMC) is strictly bound to internal, out-of-band management subnets with zero exposure to public IP addresses. Compromise Protocol (If IoCs Found):Do not attempt in-place remediation; re-image physical hardware or re-deploy virtual appliances from trusted clean media.Perform an enterprise-wide reset of all user and administrator credentials associated with the gateway.Invalidate and re-issue all multi-factor authentication (TOTP/MFA) seeds.
4. INDICATORS OF COMPROMISE (IOCs) & YARA RULEObserved Exploitation Artifacts:URI Targets: /wsproxy, /sonicwall/amc/*Common Staged Payload Paths: /tmp/, /var/tmp/, /usr/local/aventail/Suspicious Shell Patterns: Base64-decoded shell executions via standard input (sh, bash).YARA Detection Rule for Staged WebShells & Reverse Shell Hooks:Code snippetrule Exploit_SonicWall_SMA1000_Payload_Generic {
meta:
description = "Detects generic reverse shell payloads and webshell injectors targeting SMA 1000 appliance environments"
author = "SOC Threat Intel"
date = "2026-09-07"
severity = "CRITICAL"
reference = "CVE-2026-83548 / CVE-2026-83549"
strings:
// SSRF & reverse shell invocation signatures
$ssrf_endpoint = "/wsproxy" ascii wide nocase
$sh1 = "/bin/sh -i 2>&1" ascii
$sh2 = "/bin/bash -i >& /dev/tcp/" ascii
$py_sock = "socket.socket(http://socket.AF_INET,socket.SOCK_STREAM)" ascii
$php_eval = "<?php @eval($_REQUEST[" ascii
$base64_sh = "echo " ascii
$pipe_sh = "| sh" ascii
condition:
uint32(0) == 0x7f454c46 or // ELF executable
uint16(0) == 0x2123 or // Shebang #!
filesize < 2MB and
(
$ssrf_endpoint or
1 of ($sh1, $sh2, $py_sock, $php_eval) or
($base64_sh and $pipe_sh)
)
}
#CyberSecurity#ZeroDay#Infosec#SonicWall#ThreatIntel#Ransomware#IncidentResponse#Vulnerability#DFIR#PatchTuesday#CISA#CVE202683548#CVE202683549#SecOps#InfoSecCommunity#AppSec#NetworkSecuritycc: @vxunderground@campuscodi@BleepinComputer@TheHackersNews@GossiTheDog@FlorianRoth@cyb3rops@briankrebs@SwiftOnSecurity@taviso@sans_isc@DarkReading@SecurityWeek@demonslay335@hasherezade@billdemirkapi@Unit42_Intel@vxcall@malwrhunterteam@mubix
Post summary
The alert reports active exploitation of CVE‑2026‑83548/49 via SSRF and command‑injection on SonicWall SMA 1000 devices, urges immediate patching with specified firmware, and provides detailed detection and mitigation guidance.
⚠️Alerte CERT-FR⚠️
Les vulnérabilités CVE-2026-83548 et CVE-2026-83549 affectent les SMA 1000 et permettent une SSRF ainsi que l'exécution de code arbitraire à distance.
Elles sont activement exploitées.
https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009/
Post summary
CERT‑FR announces that CVE‑2026‑83548 and CVE‑2026‑83549 impact SMA 1000 devices with SSRF and remote code execution, and states these vulnerabilities are actively exploited.
🚨 On 9/1/26, #SonicWall disclosed 2 EITW vulns affecting SonicWall SMA1000 appliances.
CVE-2026-83548 & CVE-2026-83549 can be chained to achieve unauthenticated RCE on affected appliances. Find mitigation guidance and more in our blog: https://r-7.co/4AaMX4j https://t.co/kK5yFTeY8h
Post summary
The tweet reports two new CVEs (CVE-2026-83548 & CVE-2026-83549) that can be chained to achieve unauthenticated RCE on SonicWall SMA1000 appliances and directs readers to mitigation guidance via a blog post.
🚨 CVE-2026-83548 - critical 🚨
SonicWall SMA1000 WorkPlace - Unauthenticated SSRF to CouchDB
> A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place in...
👾 https://cloud.projectdiscovery.io/library/CVE-2026-83548
@pdnuclei#NucleiTemplates#cve
Post summary
This tweet announces a critical unauthenticated SSRF flaw (CVE-2026-83548) in SonicWall SMA1000 WorkPlace, detailing the target CouchDB and linking to a ProjectDiscovery detection template, but it provides no proof‑of‑concept code, exploit tool, patches, or evidence of active exploitation.
⚠️ Vulnérabilités SonicWall Secure Mobile Access (SMA).
📢 Le @CERT_FR a publié une alerte de sécurité concernant les vulnérabilités CVE-2026-83548 et CVE-2026-83549 affectant les SonicWall Secure Mobile Access (SMA).
➡️ + d'infos sur :
https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009/ https://t.co/moqj3BcYOo
Post summary
CERT France released a security alert detailing the CVE‑2026‑83548 and CVE‑2026‑83549 flaws in SonicWall Secure Mobile Access, directing readers to linked advisories for further information.
🚨 Early warning: SonicWall says vulnerabilities in its new SMA 1000 advisory are under active exploitation.
At the centre: CVE-2026-83548, a CVSS 10.0 pre-auth SSRF.
Hot fixes available. Patch now.
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 https://t.co/X6t0hq6KKv
Post summary
SonicWall reports CVE‑2026‑83548 (CVSS 10.0 pre‑auth SSRF) is actively exploited and hot fixes are available.
CVE-2026-83548, a critical SonicWall SMA1000 vulnerability, is exploited in the wild. The pre-authentication SSRF flaw scores a maximum 10.0 CVSS.
#SonicWall#SMA1000#CVE202683548#SSRF#PreAuth#VPNsecurity#InfoSec#ExploitedInTheWild
https://securityonline.info/sonicwall-sma1000-cve-2026-83548-ssrf/ https://t.co/aHAqadLrTr
Post summary
The post announces that CVE-2026-83548, a pre‑authentication SSRF vulnerability in SonicWall SMA1000, is being actively exploited in the wild.
🚨 CRITICAL: SonicWall SMA1000 vulnerabilities CVE-2026-83548 (CVSS 10.0) and CVE-2026-83549 are being actively exploited in the wild.
The vulnerabilities can be chained to achieve unauthenticated remote code execution on affected SMA1000 appliances. CVE-2026-83548 is a pre-authentication SSRF flaw, while CVE-2026-83549 is an OS command injection vulnerability.
⚠️ SonicWall has confirmed active exploitation, and both CVEs have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
🔴 Apply the latest SonicWall platform hotfixes immediately and investigate potentially exposed appliances for signs of compromise.
#SonicWall#SMA1000#CVE#ZeroDay#RCE#CyberSecurity#Infosec
Post summary
Two critical Sonciwall SMA1000 vulnerabilities are actively exploited, enabling unauthenticated remote code execution via a pre‑auth SSRF and OS command injection; SonicWall urges immediate hotfix application.
🚨 CVE-2026-83548 — SonicWall SMA 1000. Two bugs, one break-in. Disclosed Sep 1.
Who should care: anyone running a SonicWall SMA 1000 — models 6210, 7210, or 8200v, physical or virtual — on firmware 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier. That includes boxes that got the July hotfix. SMA 100 and SonicWall firewalls are not this bug.
What broke, in plain English: this box is the front door for remote workers. Bug 1 (CVE-2026-83548) tricks the door into making calls it should not make — it will reach internal admin pages for an attacker who has no password. Bug 2 (CVE-2026-83549) lets someone on those admin pages run commands on the machine. Chain them and a stranger on the internet can take over the VPN box.
Why that matters: own the VPN appliance and you sit on every remote login. Attackers can steal passwords and phone-app login codes stored on the device, then walk further into the network. Shadowserver still sees 400+ of these on the public internet.
Status: already used in real attacks. SonicWall confirmed a live case. Public as of yesterday. Not on CISA KEV yet. Second time this product line has had a zero-day wave in 2026.
Fix today: install the new hotfix — 12.4.3-03526 or later, or 12.5.0-02952 or later. Advisory SNWLID-2026-0016.
Can't patch: there is no workaround. Pull it off the internet. If you think it was hit, rebuild the box (re-image hardware, re-deploy virtual), then reset every password and every login-app code. A patch does not undo stolen keys.
Source: SonicWall PSIRT SNWLID-2026-0016 / The Hacker News
#SonicWall#VPN
Post summary
Two unauthenticated vulnerabilities (CVE‑2026‑83548/83549) in SonicWall SMA 1000 allow attackers to access admin pages and run commands, with confirmed live exploitation. A public hotfix is available; no workaround exists.
CVE-2026-83548 (CVSS 10) + CVE-2026-83549: SonicWall SMA 1000 zero-days chained for unauth RCE, actively exploited. Patch to 12.4.3-03526 / 12.5.0-02952 now. If IOCs found, re-image and rotate every credential and TOTP behind it. #CISO https://www.darkreading.com/vulnerabilities-threats/sonicwall-sma-1000-zero-days-unauthenticated-rce https://t.co/k7SPAt1PpC
Post summary
SonicWall SMA 1000 zero-days CVE-2026-83548 and CVE-2026-83549 (CVSS 10) are being actively exploited in the wild for unauthenticated RCE. Patches to versions 12.4.3-03526 and 12.5.0-02952 are available, and immediate remediation including credential and TOTP rotation is recommended.
🚨🚨🚨
1) CVE-2026-83548 - Pre-authentication SSRF via unintended forward-proxy
2) CVE-2026-83549 - Post-authentication Remote Code Execution (RCE) Vulnerability
SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016
Post summary
SonicWall has disclosed two CVEs impacting SMA1000 appliances: a pre‑authentication SSRF (CVE-2026-83548) and a post‑authentication RCE (CVE-2026-83549). The advisory link is provided but no PoC, exploit, or active‑exploitation information is included.
to be honest, i lost tracking how much actively exploited zero-days are reported, just within the past 7 days
sonicwall SMA1000 zero-day
CVE-2026-83548, CVE-2026-83549
papercut zero-day
CVE-2026-81578, CVE-2026-82078
microsoft windows privesc zero-days
CVE-2026-85880, CVE-2026-81963
cisco email gateway sql injection zero-day
CVE-2026-76461
cisco ISE auth bypass zero-day
CVE-2026-76460
google pixel modem logic error zero-day
CVE-2026-58704
ai will take our job
Post summary
The author claims that multiple zero-day vulnerabilities affecting SonicWall, PaperCut, Microsoft Windows, Cisco, and Google Pixel have been actively exploited in the wild over the past seven days.
🧱 SonicWall SMA1000 Zero-Day Chain Exploited in Active Attacks
CVE-2026-83548 and CVE-2026-83549 can be chained to bypass authentication and execute arbitrary OS commands on vulnerable SMA1000 appliances. Both vulnerabilities have been actively exploited and added to the CISA KEV Catalog.
🔎 Criminal IP Asset Search revealed:
🔹 42,286 internet-exposed assets running detectable SonicWall services worldwide
🔹 954 SonicWall SSL-VPN assets requiring priority model, version, and patch verification
🔹 Over 62% of the identified SSL-VPN assets were concentrated in the United States and Japan
Attackers can compromise vulnerable gateways and gain access to internal networks, making immediate patching and compromise assessment essential.
👉 Read the full analysis:
https://www.criminalip.io/knowledge-hub/blog/37853
#Cybersecurity#SonicWall#SMA1000#Vulnerability#ZeroDay#ThreatIntelligence#SSLVPN
Post summary
The tweet reports that two SonicWall SMA1000 zero‑day vulnerabilities have been chained to bypass authentication and execute arbitrary OS commands, and that they are already being exploited in the wild, prompting urgent patching. Asset scans reveal thousands of exposed SSL‑VPN devices, especially in the U.S. and Japan, highlighting the need for immediate remediation and compromise assessments.
『While disclosed as a 2 bug chain, looking at the patches reveals a 3 bug chain:』😲
SonicWall SMA1000 unauthenticated RCE (CVE-2026-83548 + SMA1000-9427 + CVE-2026-83549) by sfewer-r7 · Pull Request #21883 · rapid7/metasploit-framework · GitHub
https://github.com/rapid7/metasploit-framework/pull/21883
Post summary
Rapid7 released a Metasploit exploit that chains three bugs (CVE-2026-83548, SMA1000-9427, CVE-2026-83549) for an unauthenticated RCE on SonicWall SMA1000, while also discussing patch coverage.
SonicWall has disclosed two actively exploited zero-days in its SMA 1000 series (CVE-2026-83548 and CVE-2026-83549).
These can be chained for unauthenticated remote code execution.
Organizations using these appliances should apply patches immediately.
#CyberSecurity#CyberAwareness
Post summary
SonicWall disclosed that two zero‑day CVEs (CVE‑2026‑83548 and CVE‑2026‑83549) are actively exploited for unauthenticated remote code execution; users should apply patches immediately.
