Two new bugs in SonicWall’s SMA1000 remote-access appliances landed on the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026, one day after SonicWall disclosed them. One of the pair, CVE-2026-83548, carries the maximum possible CVSS score: 10.0. Federal civilian agencies got a three-day window to patch, an unusually tight deadline that signals how seriously CISA is treating active exploitation already underway.
SonicWall confirmed in its own advisory that attackers are exploiting both flaws in the wild. Rapid7 published a threat report the same week describing the pair as exploited in the wild and confirming both had been added to the KEV catalog. SC World’s coverage went further, tying the campaign to a specific ransomware operator in its headline: “INC ransomware chains two SonicWall SMA 1000 zero-days in attacks.” BleepingComputer’s own reporting, headlined “CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs,” points at the same conclusion: this isn’t theoretical risk, it’s an active breach vector against enterprise VPN gateways.
What CISA Added to the KEV Catalog on September 2
The Known Exploited Vulnerabilities catalog exists for one purpose: it tells federal agencies (and, by extension, every enterprise security team that tracks it) which bugs are not just theoretically dangerous but are actually being used in real attacks right now. Getting added to KEV is a bigger deal than getting a high CVSS score. A 9.8-rated flaw that nobody has weaponized sits quietly in a vulnerability scanner report. A flaw on the KEV list is a flaw someone is using today.
Security Affairs reported the addition in a piece titled “U.S. CISA adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog.” Both entries point at the same product line: SonicWall’s SMA1000 series of Secure Mobile Access appliances, hardware and virtual boxes that thousands of organizations use to give remote employees VPN access into internal networks. That’s exactly the kind of internet-facing, credential-adjacent infrastructure that ransomware crews have targeted for years, from Pulse Secure to Citrix NetScaler to Ivanti Connect Secure. SonicWall’s SMA1000 is now firmly in that company.
The two CVE entries break down into a matched pair. One gets an attacker through the front door without any credentials at all. The other lets an already-authenticated user run commands on the underlying system. Individually, each is bad. Chained together, security researchers say, they add up to full unauthenticated compromise of the appliance.
Inside CVE-2026-83548: A Perfect 10.0, No Login Required
CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF) bug in the SMA1000 Appliance WorkPlace interface. SonicWall’s own advisory describes it plainly: a pre-authentication SSRF via an unintended forward-proxy, rated 10.0 on the CVSS scale. NVD’s entry for the flaw matches that description, noting the vulnerability stems from an unintended alternate access path in the WorkPlace interface that a remote, unauthenticated attacker can exploit.
In plain terms: the appliance can be tricked into acting as a proxy on an attacker’s behalf, reaching internal systems it shouldn’t be forwarding requests to, and doing so for someone who has never logged in. CVSS calls this class of bug an “unintended proxy or intermediary,” sometimes shorthanded as a confused-deputy flaw. The WorkPlace interface, meant to hand remote workers a portal into internal apps, ends up handing an attacker the same reach.
A CVSS 10.0 score is rare enough that it’s worth pausing on. It means every scoring dimension, attack complexity, privileges required, user interaction, and impact on confidentiality, integrity, and availability, lines up at its worst-case value. No password, no user click, no special network position needed. That combination is precisely why CISA moved fast on this one.
Inside CVE-2026-83549: What Happens After the Front Door Opens
The second bug, CVE-2026-83549, lives in the SMA1000 Appliance Management Console, or AMC, the administrative side of the box. SonicWall classifies it as a post-authentication OS command injection issue (CWE-78, improper neutralization of special elements used in an OS command), rated 7.8 on CVSS. On its own, it requires a remote attacker to already hold administrator-level credentials, a meaningfully higher bar than CVE-2026-83548.
That’s where the chaining risk comes in. Rapid7’s analysis notes that CVE-2026-83549 can potentially be combined with CVE-2026-83548 to reach arbitrary command execution without any prior authentication at all. Read together with SC World’s report attributing exploitation to the INC ransomware group, the practical read is straightforward: the SSRF flaw gets an attacker past the login screen, and the command-injection bug hands over a shell on the box once they’re in.
How Attackers Chain the Two Bugs Into Full Takeover
Neither vulnerability needs the other to be dangerous, but together they remove the two things that usually slow an attacker down: a login wall and a privilege boundary. CVE-2026-83548’s forward-proxy behavior can be abused to reach internal-only endpoints on the appliance, including administrative functions that were never meant to be internet-facing. From there, the path to CVE-2026-83549’s command injection in the AMC shortens considerably, since the SSRF already grants a route to management-plane traffic that should have been walled off behind a login.
This is the same pattern defenders have watched play out against other VPN appliance vendors over the past three years: an SSRF or auth-bypass bug opens a crack, and a second, less severe bug turns that crack into remote code execution. It’s a cheaper attack to build than a single monolithic RCE, because each half can be developed, sold, and reused independently, and it’s harder for vendors to fully close, because patching one half without the other still leaves a partial foothold if any variant of the first bug resurfaces.
Which Appliances and Firmware Versions Are Affected
SMA 6210, 7210, and 8200v Only
SonicWall’s advisory scopes the exposure to the SMA1000 series specifically: the SMA 6210, SMA 7210, and SMA 8200v models. The company’s smaller-business SMA 100 series and its firewall product lines are separate products and aren’t named in this particular advisory. Organizations running SMA1000 as their remote-access gateway are the ones that need to move now.
Vulnerable vs. Patched Firmware Builds
SonicWall lists the vulnerable and fixed builds by exact version string:
Vulnerable firmware (SMA1000 series):
12.4.3-03453 and earlier
12.5.0-02835 and earlier
Patched firmware:
12.4.3-03526
12.5.0-02952Any SMA1000 appliance still running a build at or below those vulnerable version numbers is exposed to both CVEs. The fix isn’t a configuration workaround or a mitigation script, it’s a firmware upgrade, which for a lot of IT teams means a maintenance window, a change ticket, and a rollback plan, none of which move fast on a three-day clock.
Why CISA Gave Federal Agencies Just Three Days
CISA added both CVEs to KEV on September 2, 2026, and set the remediation deadline for September 5, 2026. A three-day patch window is short even by KEV standards, where 21-day deadlines are more typical for confirmed exploitation and 14-day windows show up for the worst cases. That compression tracks with the CVSS 10.0 score on CVE-2026-83548 and with SonicWall’s own confirmation that both bugs are being actively exploited, not just theoretically exploitable.
KEV deadlines are binding on federal civilian executive branch agencies, not on private companies. But in practice, the catalog functions as the industry’s shared urgency signal. Insurance underwriters, compliance auditors, and security operations teams at private companies routinely treat a KEV entry, especially one with a compressed deadline, as the trigger to patch immediately rather than waiting for a scheduled cycle.
Ransomware Groups Are Already in the Queue
SC World’s report is the most specific piece of attribution available so far, naming the INC ransomware group as the operator chaining the two SMA1000 zero-days in live attacks. BleepingComputer’s coverage frames the same activity more broadly, describing “ransomware gangs” (plural) exploiting the flaws following the CISA KEV listing. Taken together, the reporting points at a pattern security teams have seen before: a ransomware affiliate gets working exploit code for an edge-device bug, and within days multiple crews are using it, whether through direct code-sharing, access broker markets, or independent reverse-engineering of the same patch diff.
Rapid7’s threat report doesn’t name a specific ransomware family, sticking to confirming that both CVEs are being exploited in the wild and are now on the KEV catalog. That’s consistent with how vulnerability research firms and journalists often split the work: the technical researchers confirm exploitation exists, and separate incident-response reporting attaches names to the campaigns once they’ve triaged victim environments.
What SonicWall Has Said, and Hasn’t
SonicWall’s product notice lays out the technical detail: the CVE identifiers, the CVSS scores, the affected component for each bug, and the exact firmware builds that fix them. It confirms active exploitation, which is consistent with the KEV listing. What the advisory does not include, at least in the material publicly available, is a count of how many customers have been notified directly or how many appliances have been patched so far. Independent trackers and vulnerability research firms haven’t published a confirmed exposure count either, so any specific number of affected organizations circulating elsewhere should be treated as an estimate, not a verified figure.
SMA1000’s Third Rough Patch of 2026
This isn’t the first time SonicWall’s SMA1000 line has made the KEV catalog this year. Earlier in 2026, CVE-2026-15409, another SSRF flaw also rated CVSS 10.0, hit the same product family. Rapid7 and Volexity reported that attackers had been chaining that vulnerability with a companion bug since June 22 to hijack active VPN sessions and to systematically extract TOTP-based multi-factor authentication seed configurations from compromised appliances. Stealing an MFA seed is a different order of damage than stealing a password: it lets an attacker generate valid one-time codes indefinitely, undermining the very control that MFA was supposed to provide, until every affected seed is rotated.
Two CVSS 10.0 zero-days in the same appliance family inside a single calendar year is not a coincidence of bad luck. It’s a pattern that tends to attract more attacker attention, not less, once a product line proves it can be broken repeatedly. Security researchers and red teams who’ve found one class of bug in a codebase often go hunting for siblings, and ransomware affiliates watch KEV listings the same way defenders do, just for the opposite reason.
| Timeframe | CVE(s) | CVSS | Vulnerability Type | Reported Impact |
|---|---|---|---|---|
| Exploited from June 22, 2026 | CVE-2026-15409 (+ companion bug) | 10.0 | Pre-auth SSRF | Rapid7 & Volexity: VPN session hijacking, TOTP MFA seed theft |
| Disclosed Sept 1, added to KEV Sept 2, 2026 | CVE-2026-83548 | 10.0 | Pre-auth SSRF (forward-proxy) | SonicWall confirms active exploitation; chainable to full RCE |
| Disclosed Sept 1, added to KEV Sept 2, 2026 | CVE-2026-83549 | 7.8 | Post-auth OS command injection | SC World: chained by INC ransomware in live attacks |
| Detail | CVE-2026-83548 | CVE-2026-83549 |
|---|---|---|
| CVSS Score | 10.0 (Critical) | 7.8 (High) |
| Vulnerability Class | Pre-auth SSRF, unintended forward-proxy | Post-auth OS command injection (CWE-78) |
| Authentication Required | None | Yes, administrator-level |
| Affected Component | Appliance WorkPlace interface | Appliance Management Console (AMC) |
| Added to CISA KEV | September 2, 2026 | September 2, 2026 |
| Federal Remediation Deadline | September 5, 2026 | September 5, 2026 |
| Fixed Firmware | 12.4.3-03526 / 12.5.0-02952 | 12.4.3-03526 / 12.5.0-02952 |
SonicWall vs. Ivanti vs. Fortinet vs. Citrix: Comparing KEV Track Records
SonicWall is far from alone in this category. An independent analysis published by Security Boulevard in 2026 tallied cumulative CISA KEV entries by vendor across the security and network infrastructure space and found that products from that category account for 342 of 1,653 total KEV entries, roughly one in five confirmed actively-exploited vulnerabilities catalog-wide. Its per-vendor breakdown put Ivanti at 39 entries (concentrated in Connect Secure and Policy Secure), Citrix at 31, Fortinet at 28, and SonicWall at 27, with Zyxel at 16 and Palo Alto Networks at 15. Those figures are an independent tracker’s tally, not an official CISA per-vendor breakdown, and they predate the two newest SonicWall entries added this month.
The same analysis found that security appliance vendors’ share of annual KEV additions has been climbing: roughly 20% from 2021 through 2024, rising to 21.2% in 2025, and 25.4% in the first half of 2026 alone. Read plainly, the category of product built to secure networks is becoming a larger and larger slice of the products actively being used to break into them.
| Vendor | Cumulative CISA KEV Entries | Primary Product Focus |
|---|---|---|
| Ivanti | 39 | Connect Secure / Policy Secure VPN |
| Citrix | 31 | NetScaler ADC / Gateway |
| Fortinet | 28 | FortiOS / FortiGate |
| SonicWall | 27 | SMA / firewall appliances |
| Zyxel | 16 | Firewall / router appliances |
| Palo Alto Networks | 15 | GlobalProtect / PAN-OS |
Figures per Security Boulevard’s 2026 analysis; independent tally, not an official CISA per-vendor count, and doesn’t yet reflect the September 2, 2026 SonicWall additions.
Why Edge VPN Appliances Keep Ending Up in the KEV Catalog
The KEV catalog itself has been growing fast. Tracking site Axis Intelligence put the catalog at 1,665 entries as of its August 11, 2026 snapshot, up from 1,484 at the close of 2025, with 186 entries added in 2024 and 245 in 2025. That growth curve isn’t just CISA getting more thorough. It reflects a genuine shift in what attackers are targeting.
Edge appliances like SMA1000 sit in an uncomfortable spot architecturally: they’re internet-facing by design (that’s the whole point of a remote-access gateway), they hold or broker credentials and session tokens, and they typically run vendor-proprietary code that gets far less independent security scrutiny than mainstream operating systems or web frameworks. A bug in a VPN gateway’s web interface skips past every network perimeter control an organization has, because the appliance is the perimeter. Separately, Google’s Threat Intelligence Group counted 90 zero-days exploited in the wild in its most recent tracking period, with enterprise technology products reaching a 48% share of that total, an all-time high, according to a 2026 vulnerability statistics roundup citing the group’s findings. Edge appliances are a growing subset of that enterprise-tech category.
The Enterprise Impact: What This Means for SMA1000 Customers
For an organization running SMA1000 as its remote-access gateway, the calculus is blunt. An unpatched appliance on the vulnerable firmware list is, per SonicWall’s own advisory and multiple independent reports, actively being targeted, not merely theoretically at risk. And because CVE-2026-83548 requires no credentials at all, “we use MFA so we’re covered” doesn’t apply here the way it might against a simple credential-stuffing attack; the SSRF bug doesn’t need a password to abuse.
The cost calculation for enterprises extends past the patch itself. A compromised remote-access gateway is a foothold into the internal network it was built to protect, which is exactly the kind of access ransomware operators monetize through data theft and encryption in the same incident. Given SC World’s reporting tying this specific chain to the INC ransomware group, organizations that haven’t patched should treat this less like routine vulnerability management and more like active incident response: check logs for signs of the WorkPlace interface making unexpected outbound requests, and don’t assume a clean scan means a clean appliance if the box has been internet-facing on old firmware for any length of time since disclosure.
What Security Teams Should Do This Week
- Check the exact firmware build on every SMA1000 appliance (SMA 6210, 7210, 8200v) against the vulnerable version list above.
- Upgrade to 12.4.3-03526 or 12.5.0-02952, whichever matches your current branch, following SonicWall’s official product notice.
- Review WorkPlace interface access and outbound proxy logs for the period since disclosure for signs of SSRF abuse.
- Rotate administrator credentials for the Appliance Management Console as a precaution, since CVE-2026-83549 targets that same admin layer.
- If your organization was also affected by the earlier CVE-2026-15409 campaign, rotate TOTP MFA seeds for any accounts tied to the appliance, not just passwords.
- Treat any SMA1000 box that was internet-facing on vulnerable firmware after September 1, 2026 as a candidate for a full incident-response review, not just a patch-and-move-on.
Where This Goes From Here: Five Predictions
First, expect more named ransomware groups to show up in follow-on reporting beyond INC. Once exploit code for a CVSS 10.0 pre-auth bug is circulating, it rarely stays exclusive to one crew for long.
Second, expect proof-of-concept code for the CVE-2026-83548/83549 chain to reach public exploit databases within weeks, which will widen the attacker pool from sophisticated ransomware affiliates to opportunistic scanners running mass internet sweeps.
Third, SonicWall’s SMA1000 line will likely face continued scrutiny from independent researchers precisely because it’s now proven twice in one year to contain critical, chainable pre-auth bugs. Where one CVSS 10.0 SSRF is found, related variants often follow.
Fourth, expect the security appliance vendor share of KEV additions, already at 25.4% in the first half of 2026 per Security Boulevard’s tracking, to keep climbing through year-end as this incident and any follow-on disclosures get counted.
Fifth, expect this incident to feed the ongoing industry argument for zero-trust network access replacing traditional perimeter VPN gateways altogether, since the core problem, an internet-facing appliance that inherently trusts its own network position, isn’t unique to SonicWall and won’t be fixed by any single firmware patch.
Historical Context: A Pattern Three Years in the Making
The SMA1000 chain fits a template that’s played out repeatedly since 2023 and 2024, when Ivanti Connect Secure and Citrix NetScaler each suffered waves of pre-auth zero-days that ransomware and, in some documented cases, state-linked groups used for initial access into enterprise networks. Fortinet’s FortiOS has had its own multi-year run of KEV entries tied to VPN and SSL-VPN components. SonicWall’s own SMA product line isn’t new to this list either, independent trackers put its cumulative KEV count at 19 to 27 entries depending on methodology and cutoff date, but 2026 has been an unusually active year for the SMA1000 series specifically, with two separate CVSS 10.0 incidents inside roughly ten weeks of each other.
What’s changed since the Ivanti and Citrix waves isn’t the vulnerability class, SSRF and auth-bypass bugs in VPN gateways remain the recurring theme, but the speed of the response cycle. A one-day gap between disclosure and KEV listing, followed by a three-day federal patch deadline, is close to the fastest turnaround CISA has applied to this category of bug. That compression is itself a signal of how much confidence the agency has in the exploitation evidence SonicWall and independent researchers handed over.
Frequently Asked Questions
What are CVE-2026-83548 and CVE-2026-83549?
They are two vulnerabilities in SonicWall’s SMA1000 series remote-access appliances. CVE-2026-83548 is a pre-authentication SSRF bug rated CVSS 10.0. CVE-2026-83549 is a post-authentication OS command injection bug rated CVSS 7.8. Both were added to the CISA Known Exploited Vulnerabilities catalog on September 2, 2026.
Which SonicWall products are affected?
Only the SMA1000 series: the SMA 6210, SMA 7210, and SMA 8200v models, running firmware 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier. SonicWall’s SMA 100 series and firewall product lines are not covered by this specific advisory.
How do I patch my SMA1000 appliance?
Upgrade to firmware 12.4.3-03526 or 12.5.0-02952, depending on your current version branch, per SonicWall’s official product notice.
Are these vulnerabilities actually being exploited, or just theoretically dangerous?
SonicWall confirmed active exploitation in its own advisory. Rapid7 separately confirmed both CVEs are being exploited in the wild. SC World’s reporting ties the exploitation to the INC ransomware group, and BleepingComputer reported broader ransomware gang activity following the KEV listing.
Why did CISA only give a three-day patch deadline?
KEV deadlines scale with severity and confirmed exploitation evidence. A CVSS 10.0 pre-auth bug with confirmed active exploitation, chainable to a second bug for full remote code execution, sits at the most urgent end of that scale, which is why the window here is shorter than the more common 14- to 21-day deadlines.
Is this connected to the earlier SonicWall SMA1000 MFA seed theft incident?
It’s a separate CVE pair, but the same product family. Earlier in 2026, CVE-2026-15409, another CVSS 10.0 SSRF bug, was reportedly used to hijack VPN sessions and extract TOTP MFA seed material, per Rapid7 and Volexity. Organizations affected by that earlier campaign should rotate MFA seeds in addition to patching the new CVEs.
How does SonicWall’s KEV history compare to other VPN vendors?
Per an independent Security Boulevard analysis, Ivanti has accumulated 39 cumulative KEV entries, Citrix 31, Fortinet 28, and SonicWall 27 (a figure that predates this month’s two new additions). Security appliance vendors overall account for roughly one in five entries in the entire KEV catalog.
What should security teams do if they can’t patch within three days?
Prioritize the firmware upgrade above other maintenance work given the confirmed exploitation. If an immediate upgrade isn’t possible, review WorkPlace interface and outbound proxy logs for anomalies, restrict internet exposure of the management interface where feasible, and treat the appliance as a potential compromise pending patching, not a low-priority backlog item.
