SonicWall reported active exploitation of two vulnerabilities in its SMA 1000 remote-access appliances in a notice published September 1, 2026. The affected platform-hotfix versions are 12.4.3-03453 and 12.5.0-02835; SonicWall lists 12.4.3-03526 and 12.5.0-02952 as fixed. The title’s “days after disclosure” wording should not be read as a verified interval: the official notices confirm exploitation, but the available dated evidence does not establish exactly when exploitation began relative to public disclosure. A separate July 2026 SMA 1000 incident involved two different CVEs.
Which SonicWall vulnerability was exploited?
The most recent likely match is SonicWall’s September 1, 2026 notice, which reported that attackers were actively exploiting two SMA 1000 vulnerabilities: CVE-2026-83548 and CVE-2026-83549. The September incident is distinct from a July episode involving CVE-2026-15409 and CVE-2026-15410. Check the CVE identifiers and advisory date before applying guidance; the two pairs have different affected versions and fixes.
As an Amazon Associate I earn from qualifying purchases.
SonicWall assigned CVE-2026-83548 a CVSS score of 10.0 (Critical) and CVE-2026-83549 a score of 7.8 (High). These scores describe vulnerability severity, not the number of victims or proof that a particular appliance was compromised. (SonicWall’s September 1 notice)
Free tools Windows power users keep installed
One-click scans. No signup required.
September 2026: CVE-2026-83548 and CVE-2026-83549
| CVE | Issue and access required | Severity |
|---|---|---|
| CVE-2026-83548 | Pre-authentication server-side request forgery (SSRF) through an unintended forward proxy | CVSS 10.0, Critical (SonicWall) |
| CVE-2026-83549 | Post-authentication remote code execution (RCE) | CVSS 7.8, High (SonicWall) |
July 2026: CVE-2026-15409 and CVE-2026-15410
The Cyber Security Agency of Singapore (CSA) reported on July 15, 2026, that attackers were exploiting CVE-2026-15409, an unauthenticated SSRF issue in the SMA 1000 Appliance Work Place interface, and CVE-2026-15410, code injection in the Appliance Management Console that could let a remotely authenticated administrator run operating-system commands. CSA assigned CVSS v3.1 scores of 10.0 and 7.2, respectively. Canada’s July 14 advisory reported that CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog that day. (CSA’s July alert; Canadian Centre for Cyber Security advisory AV26-699)
#1 Best Overall
- SonicWall Global VPN Client - License (01-SSC-5311)
- Secure IPsec VPN Access: Enables encrypted remote connections to SonicWall firewalls using robust IPsec tunneling protocols.
- Consistent Remote Access Experience: Delivers a reliable and high-performance VPN connection for employees working remotely or from branch sites.
- Compatible with Windows OS: Designed for Microsoft Windows environments, with simple installation and configuration.
- Policy-Based Access Control: Enforce connection rules and restrict access to resources based on user identity and endpoint status.
Which SMA 1000 versions are affected?
SonicWall’s September notice identifies SMA 1000 models 6210, 7210 and 8200v across hypervisors. Its listed affected platform-hotfix versions and fixes are:
| Incident | Affected platform-hotfix versions listed | Fixed versions listed |
|---|---|---|
| September CVEs: CVE-2026-83548 and CVE-2026-83549 | 12.4.3-03453; 12.5.0-02835 | 12.4.3-03526; 12.5.0-02952 |
| July CVEs: CVE-2026-15409 and CVE-2026-15410 | 12.4.3-03245, 12.4.3-03387, 12.4.3-03434; 12.5.0-02283, 12.5.0-02624, 12.5.0-02800 (Canadian advisory) | 12.4.3-03453 or 12.5.0-02835, or later releases (CSA) |
The September version table comes from SonicWall’s product notice. The July affected versions and upgrade guidance come from the Canadian advisory and CSA alert. Confirm your appliance’s exact installed version and the current vendor guidance before upgrading; do not treat one incident’s version list as the other’s.
Rank #2
- Exceptional security and stellar performance at a disruptively low TCO
- No-compromise protection for your business
- Managed security for distributed environments
How to check and respond to a potentially affected appliance
- Identify the product and CVEs. Confirm that the deployment is an SMA 1000 model 6210, 7210 or 8200v, and note whether you are responding to the September CVEs or the July pair.
- Check the installed platform-hotfix version. Compare it with the affected and fixed versions in the relevant advisory. If the appliance is running an affected release, follow SonicWall’s current instructions to upgrade to the latest hotfix.
- Ask SonicWall Technical Support to review indicators of compromise (IoCs). SonicWall specifically directs organizations with affected September deployments to seek vendor assistance with IoC review. A version check alone does not establish whether an attacker accessed the appliance.
- If IoCs are found, carry out the recovery steps. SonicWall advises re-imaging hardware appliances or redeploying virtual appliances, changing all user and administrator passwords, and resetting time-based one-time password (TOTP) tokens. Coordinate the response with the vendor and your incident-response team.
SonicWall’s notice gives the remediation and recovery direction; consult its current product notice for the exact hotfix and support instructions applicable to your deployment.
Does this affect SonicWall firewalls or SMA 100 appliances?
For the July CVE-2026-15409 and CVE-2026-15410 alert, CSA explicitly said the vulnerabilities did not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series. That exclusion is specific to the July alert. It should not be extended to the September CVEs without checking the scope of SonicWall’s September notice. (CSA July alert; SonicWall September notice)
Rank #3
- SonicWall TZ370 Appliance Only - No Service Subscription (02-SSC-8441) - Designed for growing SMBs that need more throughput and scalability, delivering multi-gigabit firewall performance with best-in-class price to performance.
- Protects against encrypted malware and intrusions using DPI-SSL inspection, IPS, anti-malware, and Capture ATP sandboxing with RTDMI detection.
- Secure SD-WAN intelligently steers traffic across links to reduce MPLS costs and improve cloud application performance for branch users.
- Zero-Touch deployment, SonicExpress onboarding, and centralized management via Network Security Manager simplify rollout and ongoing operations.
- The SonicWall Secure Upgrade Program allows customers to trade in any existing SonicWall or third-party firewall for a new SonicWall Gen 7 appliance at a reduced cost. Includes eligibility for matching service subscriptions, helping organizations modernize outdated security infrastructure, simplify renewals, and ensure continued protection with the latest performance and threat defense technologies.
What does CISA KEV listing tell you?
Canada’s July advisory says the July CVEs were added to CISA’s KEV catalog on July 14, 2026; its September advisory says the September CVEs were added on September 2, 2026. KEV inclusion records that a vulnerability is known to be exploited; it is not a count of affected organizations or evidence that a specific customer was breached. (Canadian July advisory AV26-699; Canadian September advisory AV26-872)
Quick Recap
Rank #4
- SonicWALL TZ500 Network Security/Firewall Appliance
- Intrusion Prevention, Malware Protection, Application Control, Content Filtering, Spyware Protection, URL Filtering, Denial of Service (DoS), Stateful Packet Filtering, Signature-based Intrusion Prevention, Distributed Denial of Service (DDoS) - 8 Port - 10/100/1000Base-T Gigabit Ethernet - DES, 3DES, MD5, SHA-1, AES (128-bit), AES (192-bit), AES (256-bit) - USB - 8 x RJ-45 - Manageable - Power Supply - Desktop
- TZ500 Network Security FirewallExpand, control and protect your network.A fast connection to your business, school, remote office or retail site is only half the story; you also need to be able to securely manage it. The TZ500 and TZ600 give you enterprise-grade protection to stop cyberattacks as you expand and control your network.
- TZ500 TotalSecure 1YRDell SonicWALL TZ500 Appliance with 1 year of Comprehensive Gateway Security Suite and 24x7 Support
- SonicWALL 01-SSC-0445
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
