CVE-2026-83548 and CVE-2026-83549: SonicWall SMA 1000 Zero-Days Exploited in the Wild

SonicWall disclosed two actively exploited vulnerabilities in SMA 1000 appliances — a pre-authentication SSRF (CVE-2026-83548, CVSS 10.0) that can reach sensitive functionality and an OS command injection (CVE-2026-83549, CVSS 7.8) that requires admin access; evidence suggests attackers may chain them to achieve unauthenticated remote code execution. Affected models include SMA 6210, SMA 7210 and SMA 8200v on specified firmware builds; SonicWall issued hotfixes (12.4.3-03526 and 12.5.0-02952) and recommends patching, threat hunting, credential rotation, and re-imaging appliances if compromise is detected.