{"id":2398,"date":"2026-09-04T05:00:00","date_gmt":"2026-09-04T05:00:00","guid":{"rendered":"https:\/\/netguide.io\/news\/?p=2398"},"modified":"2026-09-04T05:00:00","modified_gmt":"2026-09-04T05:00:00","slug":"sonicwall-sma-1000-zero-day-cve-2026-83548-83549-en","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/en\/2026\/09\/04\/sonicwall-sma-1000-zero-day-cve-2026-83548-83549-en\/","title":{"rendered":"SonicWall SMA 1000: Two Actively Exploited Zero-Days Enable Unauthenticated RCE"},"content":{"rendered":"<div id=\"netgu-1455419067\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p class=\"wp-block-paragraph\"><strong>On September 1, 2026, SonicWall disclosed two vulnerabilities in its SMA 1000 appliances that the vendor says are already being actively exploited. Chained together, they yield unauthenticated remote code execution \u2013 full access to the VPN gateway without valid credentials.<\/strong><\/p>\n\n<h3 class=\"wp-block-heading\">The two flaws in detail<\/h3>\n\n<p class=\"wp-block-paragraph\"><strong>CVE-2026-83548<\/strong> is a pre-auth Server-Side Request Forgery (SSRF) in the &#8220;Work Place&#8221; interface, rated the maximum CVSS 10.0. It lets unauthenticated attackers reach sensitive functionality. <strong>CVE-2026-83549<\/strong> (CVSS 7.8) is an OS command injection in the Appliance Management Console (AMC) that an attacker authenticated as administrator can abuse to run arbitrary system commands. Combined, they bypass authentication and enable unauthenticated RCE. As VPN and access gateways, SMA 1000 appliances are typically exposed directly to the internet, which makes a compromise especially serious: whoever controls the appliance sits at the perimeter of the corporate network.<\/p><div id=\"netgu-1465966292\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\r\n\r\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\r\n\t\r\n\t\t\t<ul class=\"deals-top__list\">\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/amazon-kindle-scribe-64-gb-neuartiges-display-mit-gleichmaessigem-rahmen-schreib-einfach-in-buecher-und-dokumente-mit-notizbuchzusammenfassung-mit-premi\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/kindle_shopall_310mmTall-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Amazon Kindle Scribe (64 GB) \u2013 Neuartiges Display mit gleichm\u00e4\u00dfigem Rahmen | Schreib einfach in B\u00fccher und Dokumente | Mit Notizbuchzusammenfassung | Mit Premi\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">329.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>421.02 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-22%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/philips-hue-white-ambiance-e27-3er-starter-set-inkl-smart-button-dimmbar-alle-weissschattierungen-steuerbar-via-app-kompatibel-mit-amazon-alexa-echo-echo\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/61pZ0xD9KGL._AC_SL1500_-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Philips Hue White Ambiance E27 3er Starter Set inkl. Smart Button, dimmbar, alle Wei\u00dfschattierungen, steuerbar via App, kompatibel mit Amazon Alexa (Echo, Echo\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">77.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>129.99 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-40%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/philips-hue-e27-filament-grosse-edison-lampe-white-ambiance-alle-weisstoene-550-lm-dimmbar-leuchtmittel-fuer-das-hue-lichtsystem-app-und-sprachsteuerung-s\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/61UiXJLhChL._AC_SL1500_-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Philips Hue E27 Filament Gro\u00dfe Edison Lampe | White Ambiance, Alle Wei\u00dft\u00f6ne, 550 lm, Dimmbar, Leuchtmittel f\u00fcr das Hue Lichtsystem, App- und Sprachsteuerung, S\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">29.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>39.90 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-25%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ninja-foodi-max-dual-zone-heissluftfritteuse-95l-airfryer-2-faecher-mit-zange-antihaftbeschichtung-spuelmaschinenfeste-koerbe-6-in-1-amazon-exklusiv-kupfe\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/61FZ31gLeL._AC_SL1400_-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Ninja Foodi MAX Dual Zone Hei\u00dfluftfritteuse, 9,5L Airfryer, 2 F\u00e4cher, mit Zange, Antihaftbeschichtung, sp\u00fclmaschinenfeste K\u00f6rbe, 6-in-1, Amazon Exklusiv, Kupfe\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">149.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>172.47 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-13%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/samsung-galaxy-book4-edge-ai-laptop-156-zoll-display-16gb-ram-snapdragon-x-plus-prozessor-notebook-512gb-speicher-copilot-pc-sapphire-blue-3-jahre-her\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/41HJCRoes1L-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Samsung Galaxy Book4 Edge AI-Laptop, 15,6-Zoll-Display, 16GB RAM, Snapdragon X Plus Prozessor, Notebook 512GB Speicher, Copilot+ PC, Sapphire Blue, 3 Jahre Her\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">579.00 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>967.97 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-40%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t<\/ul>\r\n\r\n\t\t\t\t\t<p class=\"deals-top__more\">\r\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\r\n\t\t\t<\/p>\r\n\t\t\t<\/aside>\r\n<\/div>\n\n<h3 class=\"wp-block-heading\">Affected and patched versions<\/h3>\n\n<ul class=\"wp-block-list\"><li><strong>Affected:<\/strong> SMA 1000 models 6210, 7210 and 8200v on firmware 12.4.3-03453 or 12.5.0-02835 and earlier<\/li><li><strong>Patched:<\/strong> Hotfix 12.4.3-03526 or 12.5.0-02952 and higher<\/li><li>Not affected: the SMA 100 series and SSL-VPN on SonicWall firewalls<\/li><li><strong>To-do:<\/strong> Update to the hotfix immediately, keep the AMC off the public internet, review logs for compromise<\/li><\/ul>\n\n<h3 class=\"wp-block-heading\">Active exploitation confirmed<\/h3>\n\n<p class=\"wp-block-paragraph\">SonicWall&#8217;s PSIRT states it investigated a case indicating active exploitation and urges customers to update at once. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on September 3, 2026. Note: this incident is not the same as the earlier July case (CVE-2026-15409\/15410). Because SonicWall has not published indicators of compromise (IoCs), operators should assume possible prior compromise after patching and reset credentials and active sessions.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Sources:<\/strong> <a href=\"https:\/\/psirt.global.sonicwall.com\/vuln-detail\/SNWLID-2026-0016\" target=\"_blank\" rel=\"noopener\">SonicWall PSIRT (SNWLID-2026-0016)<\/a> \u00b7 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws\/\" target=\"_blank\" rel=\"noopener\">BleepingComputer<\/a> \u00b7 <a href=\"https:\/\/thehackernews.com\/2026\/09\/attackers-exploit-two-sonicwall-sma.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a> \u00b7 <a href=\"https:\/\/www.securityweek.com\/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks\/\" target=\"_blank\" rel=\"noopener\">SecurityWeek<\/a><\/p><div id=\"netgu-432309948\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>SonicWall warns of two flaws in its SMA 1000 appliances that, when chained, allow unauthenticated code execution. The vendor confirms active attacks \u2013 patch now.<\/p>\n","protected":false},"author":1,"featured_media":1722,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-2398","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2398","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=2398"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2398\/revisions"}],"predecessor-version":[{"id":2433,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2398\/revisions\/2433"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1722"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=2398"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=2398"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=2398"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}