Exploitation observed; activity peaked at 34 mentions and remains active
Immediate actions
Patch sonicwall sma6210 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-05. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Just added a @metasploit exploit for last weeks SonicWall SMA1000 zero-day chain that has been exploited in-the-wild (CVE-2026-83548 + SMA1000-9427 + CVE-2026-83549). It a 3 bug chain; an SSRF to CouchDB read/write for low priv RCE, to root RCE via command injection in cmsSnmpTrap. https://github.com/rapid7/metasploit-framework/pull/21883
Post summary
A Metasploit module for the SonicWall SMA1000 zero‑day chain (CVE‑2026‑83548/83549) has been released and is already being exploited in the wild, using an SSRF to achieve low‑privilege RCE and command injection for root‑level execution.
🚨 CRITICAL ZERO-DAY ALERT: SonicWall SMA 1000 Remote Access Gateways Under Active Exploitation in the Wild (CVE-2026-83548 & CVE-2026-83549) If you run SonicWall SMA 1000 appliances (SMA 6210, 7210, 8200v), your enterprise perimeter is at immediate risk of unauthenticated Remote Code Execution (RCE).Here is the complete operational briefing, identification guide, mitigation blueprint, and detection rules.
1. WHAT IS THIS THREAT?Threat actors are chaining two actively exploited zero-days to achieve unauthenticated root-level RCE on internet-facing SSL-VPN gateways: CVE-2026-83548 (CVSS 10.0 - Critical): A pre-authentication Server-Side Request Forgery (SSRF) flaw in the Appliance WorkPlace interface. It exposes an unintended forward proxy path (/wsproxy), enabling attackers without credentials to spoof client headers and tunnel HTTP requests directly into internal localhost services. CVE-2026-83549 (CVSS 7.8 - High): An OS Command Injection flaw in the Appliance Management Console (AMC). The Attack Chain: Attackers exploit the pre-auth SSRF to reach the administrative AMC endpoint internally, satisfy authentication requirements, and trigger command injection to execute arbitrary shell commands with root privileges.
2. HOW TO IDENTIFY IF YOU ARE COMPROMISEDBecause SMA appliances broker VPN sessions, credentials, and MFA seeds, attackers leverage RCE to harvest credentials and drop webshells. Inspect edge telemetry for: WorkPlace Access Logs: Look for anomalous HTTP POST/GET requests targeting /wsproxy with atypical User-Agent strings or internal IP forward targets (127.0.0.1, localhost, AMC ports).AMC Authentication Anomalies: Inspect administrative login records for admin sessions originating from 127.0.0.1, unusual high ports, or non-working hours.Outbound C2 Beacons: Network flow logs showing unexpected egress TCP traffic (direct IP outbound connections) originating from the SMA management interface.Process & Cron Anomalies: Presence of unauthorized background listeners (e.g., nc, bash -i, python/perl sockets) or modified crontabs in /etc/cron* or /var/spool/cron/.
3. MITIGATION & REMEDIATIONThere is no temporary workaround. Immediate action is required: Apply Emergency Hotfixes: Upgrade immediately to firmware:12.4.3-03526 (or later) for the 12.4 branch 12.5.0-02952 (or later) for the 12.5 branch Isolate Management Portals: Ensure the Appliance Management Console (AMC) is strictly bound to internal, out-of-band management subnets with zero exposure to public IP addresses. Compromise Protocol (If IoCs Found):Do not attempt in-place remediation; re-image physical hardware or re-deploy virtual appliances from trusted clean media.Perform an enterprise-wide reset of all user and administrator credentials associated with the gateway.Invalidate and re-issue all multi-factor authentication (TOTP/MFA) seeds.
4. INDICATORS OF COMPROMISE (IOCs) & YARA RULEObserved Exploitation Artifacts:URI Targets: /wsproxy, /sonicwall/amc/*Common Staged Payload Paths: /tmp/, /var/tmp/, /usr/local/aventail/Suspicious Shell Patterns: Base64-decoded shell executions via standard input (sh, bash).YARA Detection Rule for Staged WebShells & Reverse Shell Hooks:Code snippetrule Exploit_SonicWall_SMA1000_Payload_Generic {
meta:
description = "Detects generic reverse shell payloads and webshell injectors targeting SMA 1000 appliance environments"
author = "SOC Threat Intel"
date = "2026-09-07"
severity = "CRITICAL"
reference = "CVE-2026-83548 / CVE-2026-83549"
strings:
// SSRF & reverse shell invocation signatures
$ssrf_endpoint = "/wsproxy" ascii wide nocase
$sh1 = "/bin/sh -i 2>&1" ascii
$sh2 = "/bin/bash -i >& /dev/tcp/" ascii
$py_sock = "socket.socket(http://socket.AF_INET,socket.SOCK_STREAM)" ascii
$php_eval = "<?php @eval($_REQUEST[" ascii
$base64_sh = "echo " ascii
$pipe_sh = "| sh" ascii
condition:
uint32(0) == 0x7f454c46 or // ELF executable
uint16(0) == 0x2123 or // Shebang #!
filesize < 2MB and
(
$ssrf_endpoint or
1 of ($sh1, $sh2, $py_sock, $php_eval) or
($base64_sh and $pipe_sh)
)
}
#CyberSecurity#ZeroDay#Infosec#SonicWall#ThreatIntel#Ransomware#IncidentResponse#Vulnerability#DFIR#PatchTuesday#CISA#CVE202683548#CVE202683549#SecOps#InfoSecCommunity#AppSec#NetworkSecuritycc: @vxunderground@campuscodi@BleepinComputer@TheHackersNews@GossiTheDog@FlorianRoth@cyb3rops@briankrebs@SwiftOnSecurity@taviso@sans_isc@DarkReading@SecurityWeek@demonslay335@hasherezade@billdemirkapi@Unit42_Intel@vxcall@malwrhunterteam@mubix
Post summary
The alert reports that SonicWall SMA 1000 gateways are under active exploitation via chained SSRF and OS command injection zero-days, includes technical details, mandatory hotfixes, and detection rules.
⚠️Alerte CERT-FR⚠️
Les vulnérabilités CVE-2026-83548 et CVE-2026-83549 affectent les SMA 1000 et permettent une SSRF ainsi que l'exécution de code arbitraire à distance.
Elles sont activement exploitées.
https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009/
Post summary
CERT-FR warns that CVE-2026-83548 and CVE-2026-83549, affecting SMA 1000, are actively exploited for SSRF and remote code execution.
🚨 On 9/1/26, #SonicWall disclosed 2 EITW vulns affecting SonicWall SMA1000 appliances.
CVE-2026-83548 & CVE-2026-83549 can be chained to achieve unauthenticated RCE on affected appliances. Find mitigation guidance and more in our blog: https://r-7.co/4AaMX4j https://t.co/kK5yFTeY8h
Post summary
SonicWall disclosed two new CVEs (CVE-2026-83548 and CVE-2026-83549) that allow unauthenticated remote code execution on their SMA1000 appliances, providing mitigation guidance via a linked blog post.
⚠️ Vulnérabilités SonicWall Secure Mobile Access (SMA).
📢 Le @CERT_FR a publié une alerte de sécurité concernant les vulnérabilités CVE-2026-83548 et CVE-2026-83549 affectant les SonicWall Secure Mobile Access (SMA).
➡️ + d'infos sur :
https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009/ https://t.co/moqj3BcYOo
Post summary
A CERT alert announces CVE-2026-83548 and CVE-2026-83549 affecting SonicWall Secure Mobile Access, but the tweet provides no further technical, exploit, or remediation details.
⚠️ New Actively-Exploited Vulnerability
• CVE-2026-83549
• SonicWall SMA1000 Appliances
• OS command injection flaw
• Allows remote code execution
• Not yet linked to ransomware
Patch by 2026-09-05.
Full report: 🔗 https://darkfeed.io
#CISA#SonicWall#CyberSec https://t.co/nJrysS9zQ5
Post summary
CVE‑2026‑83549, affecting SonicWall SMA1000 appliances, is an OS command injection flaw that permits remote code execution and is reportedly being actively exploited; a vendor patch is scheduled for 2026‑09‑05.
Vendor reports wild exploitation against SonicWall SMA1000 with pre‑auth SSRF and command injection. Patches are released and vulnerability details including CVE IDs and CVSS scores are provided.
🚨 CRITICAL: SonicWall SMA1000 vulnerabilities CVE-2026-83548 (CVSS 10.0) and CVE-2026-83549 are being actively exploited in the wild.
The vulnerabilities can be chained to achieve unauthenticated remote code execution on affected SMA1000 appliances. CVE-2026-83548 is a pre-authentication SSRF flaw, while CVE-2026-83549 is an OS command injection vulnerability.
⚠️ SonicWall has confirmed active exploitation, and both CVEs have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
🔴 Apply the latest SonicWall platform hotfixes immediately and investigate potentially exposed appliances for signs of compromise.
#SonicWall#SMA1000#CVE#ZeroDay#RCE#CyberSecurity#Infosec
Post summary
The post reports that CVE-2026‑83548/49 are actively being exploited in the wild to achieve unauthenticated remote code execution via SSRF and OS command injection, and it urges immediate application of SonicWall hotfixes.
🚨 CVE-2026-83548 — SonicWall SMA 1000. Two bugs, one break-in. Disclosed Sep 1.
Who should care: anyone running a SonicWall SMA 1000 — models 6210, 7210, or 8200v, physical or virtual — on firmware 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier. That includes boxes that got the July hotfix. SMA 100 and SonicWall firewalls are not this bug.
What broke, in plain English: this box is the front door for remote workers. Bug 1 (CVE-2026-83548) tricks the door into making calls it should not make — it will reach internal admin pages for an attacker who has no password. Bug 2 (CVE-2026-83549) lets someone on those admin pages run commands on the machine. Chain them and a stranger on the internet can take over the VPN box.
Why that matters: own the VPN appliance and you sit on every remote login. Attackers can steal passwords and phone-app login codes stored on the device, then walk further into the network. Shadowserver still sees 400+ of these on the public internet.
Status: already used in real attacks. SonicWall confirmed a live case. Public as of yesterday. Not on CISA KEV yet. Second time this product line has had a zero-day wave in 2026.
Fix today: install the new hotfix — 12.4.3-03526 or later, or 12.5.0-02952 or later. Advisory SNWLID-2026-0016.
Can't patch: there is no workaround. Pull it off the internet. If you think it was hit, rebuild the box (re-image hardware, re-deploy virtual), then reset every password and every login-app code. A patch does not undo stolen keys.
Source: SonicWall PSIRT SNWLID-2026-0016 / The Hacker News
#SonicWall#VPN
Post summary
CVE‑2026‑83548 in SonicWall SMA 1000 devices is actively exploited in the wild, allowing attackers to reach admin pages and run commands. A vendor‑issued hotfix is available; there is no workaround.
CVE-2026-83548 (CVSS 10) + CVE-2026-83549: SonicWall SMA 1000 zero-days chained for unauth RCE, actively exploited. Patch to 12.4.3-03526 / 12.5.0-02952 now. If IOCs found, re-image and rotate every credential and TOTP behind it. #CISO https://www.darkreading.com/vulnerabilities-threats/sonicwall-sma-1000-zero-days-unauthenticated-rce https://t.co/k7SPAt1PpC
Post summary
The text reports two SonicWall SMA 1000 zero-days chained for unauthenticated RCE and explicitly says they are actively exploited. It also directs users to patch to specific versions and take incident-response steps if IOCs are found.
🚨🚨🚨
1) CVE-2026-83548 - Pre-authentication SSRF via unintended forward-proxy
2) CVE-2026-83549 - Post-authentication Remote Code Execution (RCE) Vulnerability
SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016
Post summary
SonicWall SMA1000 series appliances have been identified with two vulnerabilities: CVE-2026-83548 (pre‑authentication SSRF) and CVE-2026-83549 (post‑authentication RCE). No exploit code, active exploitation, or patch information is included in this announcement.
to be honest, i lost tracking how much actively exploited zero-days are reported, just within the past 7 days
sonicwall SMA1000 zero-day
CVE-2026-83548, CVE-2026-83549
papercut zero-day
CVE-2026-81578, CVE-2026-82078
microsoft windows privesc zero-days
CVE-2026-85880, CVE-2026-81963
cisco email gateway sql injection zero-day
CVE-2026-76461
cisco ISE auth bypass zero-day
CVE-2026-76460
google pixel modem logic error zero-day
CVE-2026-58704
ai will take our job
Post summary
The text lists multiple CVEs as 'actively exploited zero-days' across vendors (e.g., SonicWall, Microsoft, Cisco), emphasizing real-world exploitation risks without providing PoC code, patches, or debunking claims. Technical vulnerability types are specified, but no remediation actions are mentioned.
🧱 SonicWall SMA1000 Zero-Day Chain Exploited in Active Attacks
CVE-2026-83548 and CVE-2026-83549 can be chained to bypass authentication and execute arbitrary OS commands on vulnerable SMA1000 appliances. Both vulnerabilities have been actively exploited and added to the CISA KEV Catalog.
🔎 Criminal IP Asset Search revealed:
🔹 42,286 internet-exposed assets running detectable SonicWall services worldwide
🔹 954 SonicWall SSL-VPN assets requiring priority model, version, and patch verification
🔹 Over 62% of the identified SSL-VPN assets were concentrated in the United States and Japan
Attackers can compromise vulnerable gateways and gain access to internal networks, making immediate patching and compromise assessment essential.
👉 Read the full analysis:
https://www.criminalip.io/knowledge-hub/blog/37853
#Cybersecurity#SonicWall#SMA1000#Vulnerability#ZeroDay#ThreatIntelligence#SSLVPN
Post summary
Two SonicWall SMA1000 zero-days (CVE-2026-83548/83549) are confirmed actively exploited and listed in CISA KEV, with 42K+ exposed assets worldwide, demanding urgent patching and compromise assessment.
『While disclosed as a 2 bug chain, looking at the patches reveals a 3 bug chain:』😲
SonicWall SMA1000 unauthenticated RCE (CVE-2026-83548 + SMA1000-9427 + CVE-2026-83549) by sfewer-r7 · Pull Request #21883 · rapid7/metasploit-framework · GitHub
https://github.com/rapid7/metasploit-framework/pull/21883
Post summary
A Metasploit pull request has been submitted that provides a functional exploit for the SonicWall SMA1000 unauthenticated RCE chain involving CVE-2026-83548 and CVE-2026-83549.
SonicWall has disclosed two actively exploited zero-days in its SMA 1000 series (CVE-2026-83548 and CVE-2026-83549).
These can be chained for unauthenticated remote code execution.
Organizations using these appliances should apply patches immediately.
#CyberSecurity#CyberAwareness
Post summary
SonicWall reports CVE-2026-83548 and CVE-2026-83549 as actively exploited zero‑days enabling unauthenticated remote code execution, and urges users of the SMA 1000 series to apply patches immediately.
SonicWall SMA 1000 appliances under attack via zero-day flaws - https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/ - #0Day#Enterprise#exploit#RemoteAccess#SonicWall#Cybersecurity#CyberSecurityNews#SecurityNews
Post summary
SonicWall SMA 1000 appliances are reportedly being actively exploited in the wild via the zero‑day flaws CVE-2026‑83548 and CVE-2026‑83549, as reported in a helpnetsecurity.com article.
SonicWall SMA1000 zero-days. Already exploited.
CVE-2026-83548 + CVE-2026-83549
Chained = RCE on the appliance
Affected: 6210, 7210, 8200v
Not affected: firewalls, SMA 100
Third SMA1000 zero-day since December.
Patch today. Check your logs first.
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 https://t.co/i1ZxpRK26R
Post summary
SonicWall SMA1000 zero-days (CVE-2026-83548 & CVE-2026-83549) are actively exploited RCE vulnerabilities on specific models, and a vendor patch was released today.
SonicWall SMA1000 vulnerabilities CVE-2026-83549 and CVE-2026-83548, which allow remote code execution, are being exploited in attacks. https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/
Post summary
The post confirms that CVE-2026-83549 and CVE-2026-83548 are actively being exploited in remote code execution attacks against SonicWall SMA1000 devices.
CVE-2026-83549 is OS command injection in the Appliance Management Console. Alone it needs an authenticated admin. Chained behind the SSRF it does not. Both are confirmed exploited in the wild.
Post summary
The text identifies CVE-2026-83549 as an OS command injection vulnerability in the Appliance Management Console that can bypass authentication when chained with SSRF, explicitly stating it is confirmed exploited in the wild.
SonicWall SMA1000: pre-auth SSRF (CVSS 10) chained with AMC command injection → unauth RCE. In the wild, already on CISA KEV. Patch before your SSL-VPN becomes someone else's foothold.
https://www.rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild/
Post summary
The text reports SonicWall SMA1000 vulnerabilities (CVE-2026-83548 and CVE-2026-83549) as actively exploited in the wild and listed on CISA KEV, detailing a pre-auth SSRF chained with AMC command injection leading to unauthenticated RCE at CVSS 10, and urges immediate patching.
