SonicWall SMA1000 is being exploited again. Third time in nine months.
Two actively exploited flaws, a September 5 federal deadline, and a catch for anyone who patched in July: the build that fixed July is the build affected now. Here is what is confirmed, what is assessed, and what to do this week.
- Confirmed: SonicWall says both flaws were being exploited when it shipped the fix on September 1. CISA added both to KEV on September 2.
- Assessed: Rapid7 assesses that the flaws can potentially be chained to achieve unauthenticated remote code execution.
- Public status: no proof of concept, public indicators for this pair, or attribution; CISA's ransomware field reads Unknown.
- Do now: patch to the September builds, check whether you were exposed in July, and put something behind the gateway that can alert when an intruder interacts with it.
You run an SMA1000 appliance (model 6210, 7210, or the virtual 8200v) on 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier. That includes every appliance that took the July emergency update and nothing since.
You run the SMA 100 Series or SSL-VPN on a SonicWall firewall. SonicWall says neither is affected by this pair. Check the model anyway; the names are easy to mix up, and the SMA 100 has had its own exploited flaws.
Nine months, three exploited waves
This is not a one-off. SMA1000 has now had three separate sets of vulnerabilities exploited in the wild since December, and the last two waves reached CISA's catalog within a day of disclosure. If the appliance sits on your edge, that pattern belongs in your risk register alongside the patch.
- Dec 17, 2025CVE-2025-40602 added to KEVWave 1
Privilege escalation in the Appliance Management Console, exploited in the wild.
- Jun 22, 2026Earliest observed July compromise, three weeks before disclosureWave 2
Volexity later traces exploitation of CVE-2026-15409 and CVE-2026-15410 to this date and names the actor UTA0533, documenting ROOTRUN, KNUCKLEBALL, ORANGETAIL, and a modified Suo5 open-source proxy. Rapid7 documents stolen credentials, session databases, and TOTP seeds. Resecurity later names INC ransomware as the dominant actor weaponizing the chain.
- Jul 14, 2026SonicWall ships 12.4.3-03453 and 12.5.0-02835
The July fix. CISA later marks both July CVEs as known ransomware use.
- Sep 1, 2026CVE-2026-83548 and CVE-2026-83549 disclosed, already exploitedWave 3
Pre-authentication SSRF in Work Place and OS command injection in the management console. Fixed in 12.4.3-03526 and 12.5.0-02952. The July builds are the affected builds.
- Sep 2, 2026CISA adds both to KEV; Rapid7 publishes the chain assessment
Forensic triage required for covered federal systems.
- Sep 5, 2026Federal remediation deadline
Three days. Treat it as your benchmark even if BOD deadlines do not bind you.
Two flaws, one door
| CVE | What it is | Who can reach it alone | Score |
|---|---|---|---|
| CVE-2026-83548 | Server-side request forgery through an unintended alternate path in Appliance Work Place, the user-facing portal. CWE-918, CWE-441. | A remote, unauthenticated attacker who can reach the Work Place interface. | 10.0 Critical |
| CVE-2026-83549 | OS command injection in the Appliance Management Console, the admin side. CWE-78. | An authenticated administrator, under specific conditions. | 7.8 High |
On its own, the second flaw requires an authenticated administrator. Rapid7 assesses that the SSRF could make the command injection reachable without prior authentication, turning two flaws into one unauthenticated path to remote code execution. SonicWall confirms exploitation of both, while Rapid7 supplies the public chain assessment.
Confirmed exploitation sets the deadline. The assessed chain sets the ceiling.
Patched in July? You are in scope again
The builds that closed the July vulnerabilities are exactly the builds affected by the September pair. An appliance that took the July emergency hotfix and nothing since is vulnerable today.
Rapid7's July incident response found attackers taking credentials, active session databases, and TOTP seed configurations off compromised appliances. A stolen TOTP seed keeps generating valid codes after a password reset, and it survives the September patch. SonicWall directs customers to re-image, reset passwords, and reset TOTP tokens when indicators of compromise are found. Deception Check recommends treating those recovery steps as the default for any appliance that ran an affected build during the July window and has not been rebuilt. Resetting TOTP invalidates stolen seeds; patching and a password reset do not.
The July and September incidents remain separate stories. July has named malware and a named ransomware crew; September has neither yet. What they share is a product line, a pattern, and your patch window.
Why this is on an OT watch
An SMA1000 is not a PLC, a safety system, or a process controller. It is the box between remote users and everything they are allowed to reach: internal applications, identity services, administrative networks, and in a lot of utilities and plants, the jump path toward operational systems. Compromise of the gateway is not compromise of the process. It is the foothold from which discovery, credential use, and lateral movement start, and July showed exactly that, with the appliance's own LDAP service account authenticating to domain controllers without any VPN session behind it.
That is the placement argument, and it is the whole reason a remote-access appliance belongs on an OT watch list. It also points at the gap a patch leaves open: patching tells you nothing about what happened before the patch. A monitored decoy on the internal side creates an independent signal when discovery, credential testing, or lateral movement touches it.
Do this week
Close the path
- Find every SMA1000, including the virtual 8200v, and read the build number off the console. Anything at or below
12.4.3-03453or12.5.0-02835is affected. - Apply the hotfix:
12.4.3-03526or12.5.0-02952, or later. There is no workaround. - Confirm the Management Console is not internet-reachable. It should answer only from a management network. If it is exposed, fix that in the same change window.
Check the past
- Preserve logs before you reboot: web, authentication, management, process, and network. Then contact SonicWall Support for its indicator review.
- If indicators are found, follow the vendor's recovery guidance in full: re-image hardware or redeploy virtual appliances, reset every user and admin password, and reset TOTP tokens. Deception Check recommendation: take the same recovery steps if the appliance ran an affected build during the July window and has not been rebuilt, because patching and a password reset do not invalidate stolen TOTP seeds.
- Hunt on July's tradecraft. Rapid7 and Volexity documented the behaviors below; use them as a starting hypothesis set, not a signature set for the September CVEs.
Make the next move visible
- Restrict what the appliance can reach: least-privilege service accounts, no standing route from the remote-access zone to admin or OT networks, and egress rules that watch for the appliance initiating connections it never should.
- Put a monitored decoy behind the gateway. A fake file server, admin host, or HMI on the segment the appliance can reach can alert when an intruder interacts with it, regardless of which CVE opened the door.
- If an MSP runs this for you, ask three questions this week: what build are we on, is the management console exposed, and were we on an affected build in July.
| Look for | Why |
|---|---|
| Appliance LDAP account authenticating to domain controllers | July attackers used the appliance's integrated LDAP service account for VPN-less Active Directory authentication. |
| Unfamiliar workstation names in AD logs | Rapid7 observed non-standard names such as "kali" on authentications sourced from the appliance. |
| New or changed admin accounts, unexpected config changes | Post-exploitation on a management console usually touches the admin plane first. |
| Appliance-initiated outbound connections | July malware included a reverse proxy tunneling traffic through the appliance. |
| Valid MFA logins that do not match a user's usual pattern | Stolen TOTP seeds produce valid codes. |
Bottom line
Third exploited wave, same appliance family, and the July fix is now the affected build. Patch to the September builds. If the appliance ran an affected build during July and has not been rebuilt, re-image it, reset passwords, and reset TOTP. Then place a monitored decoy behind the gateway; the patch closes today's door, while the decoy can alert on the next interaction inside.
References
- SonicWall advisory SNWLID-2026-0016, September 1, 2026, and the SonicWall product notice with remediation and recovery guidance.
- CVE-2026-83548 and CVE-2026-83549 records, including CISA's KEV annotations.
- CISA Known Exploited Vulnerabilities catalog: CVE-2026-83548 and CVE-2026-83549 added September 2, 2026; CVE-2025-40602 added December 17, 2025.
- Rapid7, September 2, 2026: chain assessment and public-evidence status.
- Rapid7, July 15, 2026: July incident response, credential, session database, and TOTP seed theft, and LDAP service account abuse.
- Volexity, July 17, 2026: UTA0533 attribution, ROOTRUN, KNUCKLEBALL, ORANGETAIL, a modified Suo5 open-source proxy, and the earliest observed compromise on June 22.
- Resecurity, August 1, 2026: INC ransomware as the dominant actor weaponizing the July SMA1000 chain.
- NVD, CVE-2025-40602: December 2025 SMA1000 management console privilege escalation.
Scoring note: CISA's ADP entries provide the 10.0 and 7.8 CVSS v3.1 scores; SonicWall's CNA entries do not. CVE-2026-83549's prose describes a remote, authenticated administrator, while its vector lists AV:L. The records do not reconcile the difference, so this article follows the vendor's prose.