SonicWall SMA1000: Chaining CVE-2026-83548 and CVE-2026-83549
SonicWall SMA1000: Chaining CVE-2026-83548 and CVE-2026-83549 Why an SSL VPN gateway is a high-value target A remote access gateway sits between the internet and the internal network and holds the session context of every user who connects through it. SonicWall published fixes and confirmed exploitation of two flaws in the SMA1000 series on 1 September 2026, and CISA added both to the Known…
SonicWall released security patches for two critical vulnerabilities, CVE-2026-83548 and CVE-2026-83549, in its SMA1000 series SSL VPN gateway on September 1, 2026. The vulnerabilities were publicly disclosed and added to the Known Exploited Vulnerabilities catalog by the Cybersecurity and Infrastructure Security Agency (CISA) the following day. The two flaws, when exploited together, allow an unauthenticated attacker to gain command execution privileges on the gateway.
CVE-2026-83548 is a pre-authentication server-side request forgery in the Work Place portal. This type of attack enables an attacker to manipulate the appliance into issuing requests on their behalf, potentially reaching services that are only accessible from the appliance's network position. This vulnerability is rated with a CVSS score of 10.0 and is considered a confused deputy problem.
CVE-2026-83549 is an OS command injection vulnerability in the Advanced Management Console, which affects the administrative interface. This flaw, rated with a CVSS score of 7.8, requires administrative access to exploit. When chained with the first vulnerability, the command injection converts the SSRF position into actual code execution, granting the attacker full control over the gateway.
These two vulnerabilities are particularly dangerous when exploited together because they combine a moderate-severity issue (CVE-2026-83548) with a higher-severity issue (CVE-2026-83549) on the same appliance. When they share a network position and a privilege boundary, the vulnerabilities become more potent and pose a higher risk to the organization.
To remediate the vulnerabilities, SonicWall released updated firmware versions 12.4.3-03526 and 12.5.0-02952. Organizations are advised to apply these patches as soon as possible to protect their SSL VPN gateways. After applying the patches, it is crucial to review VPN authentication logs for any suspicious activity, inspect the appliance for any unauthorized configuration changes, and rotate credentials and session tokens issued before the upgrade.
This proactive approach will help ensure that the organization's network remains secure even after the vulnerabilities have been addressed.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
