SonicWall published an advisory on 2 September 2026 for two flaws in the SMA 1000 remote access appliance, and says it investigated a case indicating active exploitation.

CVE-2026-83548 — CVSS 10.0 — is a pre-authentication server-side request forgery in the Appliance Work Place interface, giving access to sensitive functionality with no credentials.

CVE-2026-83549 — CVSS 7.8 — is a post-authentication OS command injection in the Appliance Management Console, allowing an authenticated administrator to run arbitrary commands.

Affected models are the 6210, 7210 and 8200v. Vulnerable builds are 12.4.3-03453 and earlier and 12.5.0-02835 and earlier; the fixes are 12.4.3-03526 and 12.5.0-02952.

Seven weeks ago, the same two classes

This is the part that is not in the coverage, and it comes straight from the CISA catalogue rather than from anyone's summary.

On 14 July 2026, CISA added two SMA1000 flaws to the Known Exploited Vulnerabilities catalogue on the same day:

  • CVE-2026-15409 — "SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location."
  • CVE-2026-15410 — "SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands."

Read those against the two new ones. Same appliance. Same two vulnerability classes. Same authentication positions — unauthenticated SSRF, administrator-level command execution. Seven weeks apart. Both rounds exploited.

Be careful about what that does and does not prove. Nothing published says the September flaws are variants of the July ones, or that the July fix was incomplete, and we are not asserting either. But "the same two bug classes reappeared in the same product in seven weeks" is a fact, and the question it raises — regression, variant, or the same code paths producing the same defects — is the one an operator should be asking their vendor.

The July pair also tells you how CISA read it. Added 14 July, remediation due 17 July: a three-day deadline. That is the treatment reserved for things being actively used against federal networks.

SonicWall now has 17 entries in the KEV catalogue.

Both are now in KEV, with a three-day deadline

When this was published, neither CVE appeared in the catalogue — 1,687 entries as of 1 September 2026 — and we said that was not reassurance, only the window in which KEV runs behind observed exploitation.

Update, 2 September 2026: CISA added both, along with five other flaws, and set the remediation deadline at 5 September. Three days, the same treatment the July pair got.

The window was 48 hours. If you waited for the catalogue, you spent it.

The chain is suggested, not confirmed

SonicWall's language points at the two being used together, and the shape is obvious enough: a pre-auth SSRF that can reach the management console, then command injection at that console.

But the specific sequence is not confirmed in the disclosure. Neither is the number of exposed devices, the attacker's identity, or what they do after landing. Anyone writing "attackers are chaining these" is filling in a gap the vendor left.

A CVSS 10.0 on an SSRF is itself a hint, though. SSRF alone does not usually score that. A 10.0 means the scope changed — the flaw lets an attacker reach something beyond the component that contains it, which is the definition of a useful first link.

What to do

  • Patch to 12.4.3-03526 or 12.5.0-02952. Treat it as an emergency; the vendor says exploitation is happening.
  • The KEV deadline is 5 September. Both CVEs were added on 2 September with a three-day clock.
  • Check the management console's exposure. The second flaw needs administrator authentication; the first is a way to reach things you did not intend to expose. Reducing what the console can be reached from breaks the useful half of the pairing.
  • Assume compromise if you were behind on the July pair too. Those had a three-day federal deadline and the same appliance.
  • Ask SonicWall the regression question. Whether these are new code paths or old ones is information you are entitled to before the next round.

What is not established

  • Whether the two September flaws are actually chained in the observed exploitation.
  • Whether they relate to the July pair in any way beyond sharing a product and two vulnerability classes.
  • How many appliances are exposed. Not disclosed.
  • Who is exploiting them. No attribution offered.
  • What happens post-exploitation. The advisory does not say.