# SonicWall Warns of Two Actively Exploited Zero-Days in SMA1000 Remote Access Appliances

*2026-09-03 10:02 UTC · Technology · 1 min read*

> SonicWall disclosed two actively exploited zero-day flaws in its SMA1000 remote-access appliances that can be chained for full unauthenticated remote code execution.

SonicWall disclosed on September 2 that attackers are actively exploiting two chained zero-day vulnerabilities in its SMA1000 series remote access appliances, used by enterprises and managed service providers to grant secure remote access to internal networks.

CVE-2026-83548, a maximum-severity flaw in the SMA1000 WorkPlace interface, stems from a server-side request forgery weakness and requires no authentication to exploit. CVE-2026-83549, found in the Appliance Management Console, needs admin privileges but lets attackers run arbitrary OS commands. Researchers say the two can be chained into full unauthenticated remote code execution. The bugs affect the SMA1000 6210, 7210 and 8200v models; SSL-VPN on SonicWall firewalls and the SMA 100 Series are not impacted.

SonicWall's incident response team urges customers to install the hotfix immediately, and to re-image any appliance suspected of compromise, reset all administrator and user passwords, and reissue TOTP multi-factor tokens — steps that go beyond a routine patch and suggest the company suspects attackers may already have gained persistent footholds on some devices.

## Sources

- [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/)
- [securityweek.com](https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/)

---
TechTools News · https://techtools.cz/tools/news/article/2305-sonicwall-warns-of-two-actively-exploited-zero-days-in-sma1000-remote-access
Česká verze: https://techtools.cz/tools/news/clanek/2378-sonicwall-varuje-pred-dvema-aktivne-zneuzivanymi-zero-day-chybami-v-zarizenich