SonicWall customers are once again facing actively exploited zero-day vulnerabilities in the company's SMA 1000 appliances. The vendor disclosed and patched two new defects, CVE-2026-83548 and CVE-2026-83549, on Tuesday, confirming that both were already being exploited in the wild. The Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday.
Researchers at Rapid7 have analyzed the new zero-days, identifying CVE-2026-83548 as a maximum-severity pre-authentication server-side request forgery (SSRF) vulnerability and CVE-2026-83549 as a high-severity OS command injection vulnerability. When chained together, these two flaws can enable unauthenticated remote code execution on affected devices.
The disclosure did not specify the number of customers impacted or the initial date of exploitation. SonicWall stated that the vulnerabilities were discovered internally but also noted an investigation into active exploitation, a combination of statements that has led to some confusion regarding the timeline of discovery and compromise. The company's security advisory did not include indicators of compromise (IOCs), instead directing customers to contact tech support for assistance in identifying potential signs of compromise. If compromise is detected, SonicWall advises re-imaging or re-deploying the appliance, changing all user and administrator passwords, and resetting tokens.
This latest incident continues a pattern of security challenges for SonicWall's SMA 1000 product line, which has been a frequent target for attackers. Since mid-December 2025 alone, five vulnerabilities affecting SMA 1000 appliances have been added to CISA's KEV catalog. In total, ten of the nineteen SonicWall defects added to the KEV catalog since late 2021 are known to be leveraged in ransomware campaigns, with groups like INC ransomware and Akira showing particular interest.
Previous incidents include an attack in late July where researchers observed a spree compromising 30 SonicWall customers in less than two days. Earlier that same month, SonicWall acknowledged another pair of zero-days that had been actively exploited for three weeks before patches were released. Last year, a state-sponsored threat group reportedly exploited a vulnerability to steal firewall configurations from all SonicWall customers.
