SonicWall has notified customers of two new zero-day vulnerabilities that are being exploited in the wild, one of which is a maximum-severity flaw.

A security advisory published by the vendor on September 1 revealed that the bugs affect SMA1000 appliances, specifically models 6210, 7210 and 8200v.

Impacted versions are 12.4.3-03453 (platform-hotfix) and older, and 12.5.0-02835 (platform-hotfix) and older. 

The SMA or Secure Mobile Access appliances are gateway devices designed to enable remote workers to securely connect to corporate networks.

Read more on SonicWall SMA appliances: SonicWall Probes Attack Using Zero-Days in Own Products.

The more critical of the two zero days is CVE-2026-83548: a pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface.

It exists due to an “unintended alternate access path,” SonicWall said in its advisory. “A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations,” it added.

The flaw has a CVSS score of 10.0.

The second zero day is CVE-2026-83549: a post-authentication remote code execution (RCE) vulnerability in the SMA1000 Appliance Management Console, which has a CVSS score of 7.8.

It’s described as a “post-authentication improper neutralization of special elements used in an OS command” which “in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.”

Remediation Guidance for SonicWall Customers

SonicWall urged customers to take action, whether they’re running virtual or physical SMA1000 appliances.

It said they should:

• Upgrade to the latest hotfix version
• Contact SonicWall Technical Support for assistance in looking for indicators of compromise (IoCs)
• If IOCs are detected on the system: re-image hardware or re-deploy appliances, change all user and admin passwords, and reset TOTP tokens

SonicWall SMA1000 appliances are popular targets for state-sponsored and ransomware actors because, as edge devices, they provide remote access to sensitive corporate resources.

Security agencies regularly warn of threats to these devices. In February 2025, Five Eyes agencies published guidance for manufacturers of edge devices designed to improve baseline security.