Posted on

SonicWall SMA1000 CVE-2026-83548 and CVE-2026-83549 – Actively Exploited Zero-Day Chain

Threat Overview

SonicWall disclosed two new vulnerabilities affecting Secure Mobile Access (SMA) 1000 appliances on September 1, 2026 and confirmed that both are being actively exploited. CVE-2026-83548 is a CVSS 10.0 pre-authentication SSRF issue in Appliance Work Place. CVE-2026-83549 is a CVSS 7.8 operating-system command-injection issue in Appliance Management Console. SonicWall confirmed exploitation of both issues but has not published a complete attack sequence, actor attribution, payload set, or stable exploit IOCs.

References

Impacted Systems

  • SonicWall SMA 6210, 7210, and 8200v on supported hypervisors.
  • Affected 12.4.3 branch: platform-hotfix 12.4.3-03453 and older affected builds.
  • Affected 12.5.0 branch: platform-hotfix 12.5.0-02835 and older affected builds.
  • Fixed: 12.4.3-03526 and 12.5.0-02952 or later applicable hotfixes.
  • CVE-2026-83548 requires no authentication. CVE-2026-83549 requires authenticated administrator context when exploited independently.
  • SMA100 and firewall SSL-VPN products are not affected by these two issues.

Why this matters

Confirmed exploitation of an Internet-facing remote-access appliance creates immediate risk because compromise can occur at the perimeter and may expose authentication material and administrative access before endpoint controls are involved.

Exploitation Status

Confirmed active exploitation by SonicWall. No reliable public exploit request signature or stable payload IOC set was available at publication time.

What this hunt looks for

New external sources reaching SMA1000 appliances, abnormal HTTPS request bursts, administrative or authentication activity, appliance errors or restarts, unusual outbound connections, and inbound-to-outbound network correlation.

Required logs

  • CommonSecurityLog or equivalent firewall/proxy telemetry
  • Syslog from SMA1000 appliances where available

Hunt 1 – First-Pass: Newly Seen External Sources

let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(7d))
| where DeviceVendor has "SonicWall"
| where DeviceProduct has_any ("SMA","Secure Mobile Access")
| summarize by SourceIP, DestinationIP;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceVendor has "SonicWall"
| where DeviceProduct has_any ("SMA","Secure Mobile Access")
| join kind=leftanti Baseline on SourceIP, DestinationIP
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Ports=make_set(DestinationPort,20), Actions=make_set(DeviceAction,20), URLs=make_set(tostring(column_ifexists("RequestURL","")),30) by SourceIP, DestinationIP
| sort by FirstSeen desc

Hunt 2 – Repeated HTTPS Requests

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor has "SonicWall"
| where DeviceProduct has_any ("SMA","Secure Mobile Access")
| where DestinationPort in (443,8443)
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), URLs=make_set(tostring(column_ifexists("RequestURL","")),50), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, bin(TimeGenerated,10m)
| where Requests >= 50
| sort by Requests desc

Hunt 3 – Administrative or Authentication Events

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("SMA","Secure Mobile Access","AMC","Appliance Management Console")
| where SyslogMessage has_any ("admin","administrator","login","authentication","session","configuration","command")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Hunt 4 – Error, Crash, or Restart Events

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("SMA","Secure Mobile Access","AMC","Appliance Work Place")
| where SyslogMessage has_any ("error","failed","crash","segfault","terminated","restart","exception","core")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Hunt 5 – External Source Followed by Appliance Outbound Activity

let Inbound = CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor has "SonicWall"
| where DeviceProduct has_any ("SMA","Secure Mobile Access")
| where DestinationPort in (443,8443)
| project InboundTime=TimeGenerated, ApplianceIP=DestinationIP, ExternalSource=SourceIP;
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| join kind=inner Inbound on $left.SourceIP == $right.ApplianceIP
| where TimeGenerated between (InboundTime .. InboundTime + 15m)
| where DestinationIP != ExternalSource
| project InboundTime, TimeGenerated, ApplianceIP, ExternalSource, DestinationIP, DestinationPort, Protocol, DeviceAction, Message
| sort by InboundTime asc

Hunt 6 – Rare New Outbound Destinations

let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(7d))
| where DeviceVendor has "SonicWall"
| where DeviceProduct has_any ("SMA","Secure Mobile Access")
| summarize by SourceIP, DestinationIP, DestinationPort;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceVendor has "SonicWall"
| where DeviceProduct has_any ("SMA","Secure Mobile Access")
| join kind=leftanti Baseline on SourceIP, DestinationIP, DestinationPort
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort
| sort by FirstSeen desc

Hunt 7 – High-Rate Requests

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor has "SonicWall"
| where DeviceProduct has_any ("SMA","Secure Mobile Access")
| summarize Events=count(), Ports=dcount(DestinationPort), URLs=dcount(tostring(column_ifexists("RequestURL",""))) by SourceIP, DestinationIP, bin(TimeGenerated,5m)
| where Events >= 200 or URLs >= 30
| sort by Events desc

Detection Notes

  • Highest signal comes from appliance-specific anomalous activity correlated with known affected SMA1000 assets.
  • SonicWall has not published exploit request paths or packet signatures for these CVEs.
  • Raw HTTPS volume can be noisy. Scope by known SMA1000 addresses where possible.
  • CommonSecurityLog mappings vary by connector.
  • Without detailed appliance or network telemetry, successful exploitation may have little visibility in Sentinel.

Leave a comment