SonicWall warns of actively exploited SMA1000 zero-day flaws

SonicWall warns of active exploitation of two chained zero-day vulnerabilities in SMA1000 appliances (CVE-2026-83548 and CVE-2026-83549) that allow remote command execution; customers are urged to apply hotfixes, re-image appliances, change credentials, and reset TOTP if IOCs are found. The flaws affect SMA1000 6210, 7210, and 8200v models, Shadowserver reports 400+ exposed appliances, and the advisory ties into prior exploitation by ransomware groups and state-backed actors.