CVE-2026-83549

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-83549 7.8

SonicWall · SMA1000 Appliances · Added 2026-09-02 · Published 2026-09-01

3-Day Required KEV Active Exploitation

Details

VulnerabilitySonicWall SMA1000 Appliances OS Command Injection Vulnerability

VendorSonicWall

ProductSMA1000 Appliances

Date added2026-09-02

Due date2026-09-05

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-78

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

NVD: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-02 18:39 UTC

Component defaultyes

Sources https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016
https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/
https://www.sophos.com/en-us/blog/sonicwall-83548-83549
https://www.infosecurity-magazine.com/news/hackers-chain-sonicwall-zeroday/
https://securityaffairs.com/198303/security/sonicwall-patches-two-new-actively-exploited-zero-days-in-sma-1000-vpns.html

Hunting hypothesis agent

Hunt SMA1000 AMC logs for admin sessions immediately following SSRF-related Work Place requests. Correlate CVE-2026-83548 indicators with subsequent console access from same source IP.

Research details

ComponentAppliance Management Console (AMC) post-auth command injection

PreconditionsNetwork reachability to SMA1000 Appliance Management Console (AMC); administrator authentication required (post-auth); often chained after CVE-2026-83548 (pre-auth SSRF) to obtain admin credentials; no specific version range disclosed in advisory beyond 'all affected versions' agent

Public PoCno

Advisoryhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016

Exploit notesPost-authentication command injection in the AMC console. When chained with CVE-2026-83548 (pre-auth SSRF), the attacker first obtains admin credentials via SSRF, then exploits this to achieve full RCE. Actively exploited as part of a zero-day chain. CVSS attack complexity: LOW | HIGH severity (CVSS 7.8)

SummaryCVE-2026-83549 is a post-authentication OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC). An authenticated administrator can inject arbitrary OS commands for RCE. In the wild, attackers chain this with CVE-2026-83548 (pre-auth SSRF) to first obtain admin credentials, then achieve full device compromise. This is the third SMA1000 exploitation chain in seven weeks following July 2026 ROOTRUN/KNUCKLEBALL campaigns.

Tia coverage

First reported2026-07-15

First exploit report2026-09-02

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

active-exploitation-of-cisco-secure-firewall-management-center-v sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.