A critical OS command injection vulnerability in SonicWall SMA1000 appliances, identified as CVE-2026-83549, was exploited on the same day it was publicly disclosed. The vulnerability, which carries a CVSS score of 7.8, was published on September 1, 2026, and subsequently added to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026.
The flaw exists within the SMA1000 Appliance Management Console (AMC) and is described as an "Improper Neutralization of Special Elements used in an OS Command." Under specific conditions, this post-authentication vulnerability could allow a remote authenticated attacker with administrative privileges to execute arbitrary operating system commands, potentially leading to remote code execution.
Evidence of active exploitation emerged rapidly. VulnCheck KEV, a commercial research entity, listed the vulnerability as exploited on September 1, 2026, the same day as its disclosure. The EUVD (ENISA, European Union) and CISA KEV catalogs both confirmed exploitation by September 2, 2026. Multiple public reports detailing exploitation were collected starting September 1, 2026, with the latest sighting of exploitation activity recorded on September 4, 2026.
CISA has issued a directive requiring federal agencies to apply vendor-provided mitigations by September 5, 2026. This mandate falls under CISA’s BOD 26-04, which prioritizes security updates based on risk. For cloud services or situations where mitigations are unavailable, CISA advises discontinuing product use. Stakeholders are responsible for assessing their assets' internet exposure and ensuring compliance with these patching guidelines.
SonicWall has acknowledged the vulnerability with the identifier SNWLID-2026-0016 and has published details on their PSIRT portal. The rapid exploitation highlights the critical importance of applying security updates promptly, especially for vulnerabilities that are publicly disclosed and quickly added to known exploited lists.
