SonicWall’s September 2026 SMA1000 advisory is not an isolated disclosure: it is the third significant SMA1000 vulnerability group reported in 2026, and the July and September groups were both reported as actively exploited. That supports a pattern of recurring high-impact exposure and urgent patching in this product family. It does not prove that every SonicWall vulnerability was exploited, that all SonicWall products share one underlying flaw, or that the separate incidents have a common root cause.
What is the latest SonicWall issue?
On September 2, 2026, the Canadian Centre for Cyber Security reported that SonicWall had identified active exploitation of two vulnerabilities affecting the SMA1000 secure-access appliance family: CVE-2026-83548 and CVE-2026-83549. The advisory names SMA1000 models 6210, 7210, and 8200v, and lists versions 12.4.3-03453 and older, and 12.5.0-02835 and older, as affected. It also reports that CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog that day.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
SonicWall TZ470 Network Security/Firewall Appliance | $825.31 | Buy on Amazon |
| 2 |
|
SonicWall TZ270W Wireless Gen7 Firewall | SMB Wi-Fi Security Appliance with 2 Gbps Firewall Speed,... | $468.00 | Buy on Amazon |
| 3 |
|
Sonicwall NSA 2700 (02-SSC-4324) | $2,159.20 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
How the September vulnerabilities work
The CIS/MS-ISAC technical advisory describes CVE-2026-83548 as a pre-authentication server-side request forgery (SSRF) flaw in the Appliance Work Place interface. An unauthenticated remote attacker could reach sensitive functionality and perform unauthorized operations. CVE-2026-83549 is a post-authentication operating-system command-injection flaw in the Appliance Management Console; under specific conditions, an authenticated remote administrator could execute arbitrary operating-system commands. The advisory says the flaws can be chained to achieve remote code execution and full system compromise.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat is not established about the September fixes
The readable September advisories establish affected versions and reported exploitation, but do not establish the fixed versions or provide complete recovery instructions. Administrators should get the current remediation and recovery guidance from SonicWall’s advisory or support channel rather than infer a fix from a different incident.
#1 Best Overall
- The latest SonicWall TZ470 series, are the first desktop form factor nextgeneration firewalls (NGFW) with 1 or 5 Gigabit Ethernet interfaces. The series consist of a wide range of products to suit a variety of use cases.
- Reduce complexity and get the business running without relying on IT personnel with easy onboarding using SonicExpress App and Zero-Touch Deployment, and easy management through a single pane of glass
- Drive business growth by investing in next-gen appliances with multi-gigabit and advanced security features, to future-proof against the changing network and security landscape
- Ensure seamless communication as stores talk to HQ via easy VPN connectivity which allows IT administrators to create a hub and spoke configuration for the safe transport of data between all locations
- Hardware: Operating system: SonicOS 7. | Interfaces: 8x1GbE, 2x1GbE, 2 USB 3., 1 Console | Management: Network Security Manager, CLI, SSH, Web UI, GMS, REST APIs | VLAN interfaces: 128 | Access points supported (maximum): 32
Why this looks like a recurring pattern—and where the evidence stops
The clearest pattern is within SMA1000: separate vulnerability disclosures in April, July, and September 2026, followed by urgent upgrade guidance, with exploitation reported for the latter two groups. The April notice is an important qualification: SonicWall said at that time it was not aware of active exploitation of those April vulnerabilities. Repeated disclosure is evidence of recurring exposure, not proof that the April issues were exploited.
| Disclosure | Product and vulnerabilities | Exploit status and impact | Remediation information established |
|---|---|---|---|
| April 2026 | SMA1000: CVE-2026-4112 (SQL-injection privilege escalation, CVSS 7.2), CVE-2026-4113 (credential enumeration, CVSS 5.3), CVE-2026-4114 (AMC TOTP bypass, CVSS 6.6), and CVE-2026-4116 (Workplace/Connect Tunnel TOTP bypass, CVSS 6.0). Scores and descriptions are from SonicWall’s April 2026 notice. | SonicWall said it was not aware of active exploitation at the time. | SonicWall advised customers to upgrade; the specific fixed versions are not stated in the available April advisory summary. |
| July 2026 | SMA1000: CVE-2026-15409, SSRF (CVSS 10.0), and CVE-2026-15410, remote code execution (CVSS 7.2). Scores are from SonicWall’s July 2026 notice. | SonicWall confirmed active exploitation; the Canadian Centre for Cyber Security also reported CISA KEV additions. | SonicWall specified fixed versions 12.4.3-03453 and later, or 12.5.0-02835 and later, for this July pair. |
| September 2026 | SMA1000: CVE-2026-83548, pre-authentication SSRF, and CVE-2026-83549, post-authentication command injection. CVSS scores are not stated in the September advisory summaries cited here. | Active exploitation reported; the CIS/MS-ISAC advisory says the flaws can be chained to full system compromise. CISA KEV additions were reported on September 2. | Affected versions are identified, but the September fixed versions are not stated in the cited advisories. |
Other SonicWall notices provide broader security context but should not be merged into the SMA1000 sequence. A December 2025 SonicOS advisory concerned improper access control affecting firewall management access and SSLVPN; SonicWall said it was potentially being exploited. An April 2026 advisory for Gen 6, Gen 7, and Gen 8 firewalls urged firmware updates and offered temporary exposure-reduction measures. These separate product incidents show ongoing security maintenance across the vendor’s portfolio, not a demonstrated common defect.
Rank #2
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
What SMA1000 administrators should do
- Check whether your appliances are in scope. Inventory SMA1000 6210, 7210, and 8200v devices and compare their installed firmware with the September affected ranges: 12.4.3-03453 and older, or 12.5.0-02835 and older.
- Obtain the September-specific fix and recovery steps. Use SonicWall’s current advisory or support channel to confirm the corrected release for your branch and the supported upgrade path. Do not treat the July pair’s fixed-version numbers as September remediation.
- Assess for compromise as well as patch. Because exploitation was reported, review appliance and network activity for suspicious access or changes. A successful upgrade alone does not establish that the appliance was never compromised; escalate findings through your incident-response process.
- Follow guidance for the incident you are handling. SonicWall’s July notice instructed customers to upgrade and conduct forensic analysis for indicators of compromise. For July incidents where indicators were found, it advised re-imaging hardware or redeploying virtual appliances, changing user and administrator passwords, and resetting TOTP tokens. Those instructions were published for the July CVEs; do not assume they are the correct September recovery procedure without checking SonicWall’s September-specific guidance.
How to interpret the wider SonicWall security record
The responsible conclusion is specific: in 2026, SMA1000 customers faced three separate disclosed vulnerability groups, and exploitation was reported for the July and September groups. The cited sources do not provide a population-level breach count or an independent incident-count estimate, and the advisory sequence does not establish that every vulnerability or product family was exploited. Nor does it show that the separate flaws share a root cause.
For the distinct SonicOS and firewall advisories, use their own product and incident guidance. SonicWall’s December 2025 SonicOS notice advised patching and restricting firewall management and SSLVPN access to trusted sources, or disabling internet access to those services. Its April 2026 firewall notice listed temporary measures including disabling HTTP/HTTPS management and SSL-VPN and restricting management to SSH while recommending prompt firmware updates. These are product-specific exposure reductions, not substitutes for the SMA1000 remediation path.
Quick Recap
Rank #3
- The SonicWall Network Security appliance (NSa) Mid-Range Firewall is next-generation security designed specifically for businesses of 250 users and up.
- Secure Remote Workers - SonicWall NetExtender provides an intuitive SSL-VPN connection client that’s easy to deploy and configure. Easily provide your remote workers with secure access to your corporate network from Linux, Mac and Windows devices.
- Built-in Wireless Controller - Implement high-speed wireless security by combining a NSa Series next-generation firewall with a SonicWall SonicWave wireless access point. NSa Series firewalls and SonicWave access points both feature 2.5 GbE ports that enable multi-gigabit wireless throughput offered in Wave 2 wireless technology.
- With cloud-based and on-box capabilities like TLS/SSL decryption and inspection, application intelligence and control, secure SD-WAN, real-time visualization, and WLAN management, SonicWall provides flexible, fast and cost-effective security to keep the threats out and your business thriving.
- Highlights: 1 RU – Form Factor | 16 x 1 GbE interfaces | 3 x 10 GbE interfaces | 2 Gbps Threat and Malware Analysis Throughput | Enterprise Internet Edge Ready
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
