CVE-2026-83549
Description
CVE-2026-83549 is a high-severity RCE vulnerability in SonicWall SMA1000 appliances. Actively exploited; update firmware to prevent command injection.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| sma8200v | * | 12.4.3-03526 | vulnerable |
| sma8200v | 12.5.0 | 12.5.0-02952 | vulnerable |
| sma8200v | - | - | unaffected |
| sma6210_firmware | * | 12.4.3-03526 | vulnerable |
| sma6210_firmware | 12.5.0 | 12.5.0-02952 | vulnerable |
| sma6210 | - | - | unaffected |
| sma7210_firmware | * | 12.4.3-03526 | vulnerable |
| sma7210_firmware | 12.5.0 | 12.5.0-02952 | vulnerable |
| sma7210 | - | - | unaffected |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately download and install the security patches provided by SonicWall for the SMA1000 series. Refer to SonicWall advisory SNWLID-2026-0016 for specific patch instructions for SMA 6210, 7210, and 8200v platforms.
Update affected systems
Ensure all SMA1000 appliances are updated to firmware versions 12.4.3-03526 or 12.5.0-02952 and above. Verify that no legacy or unpatched virtual appliances (SMA 8200v) remain active in the environment.
Restrict access
Limit access to the Appliance Management Console (AMC) to authorized administrative personnel only via a management VLAN or VPN. Enforce strict Multi-Factor Authentication (MFA) for all administrative accounts to prevent unauthorized access.
Monitor for exploitation
Review system logs for unusual shell command activity or unauthorized changes to the appliance configuration. Follow CISA’s Forensics Triage Requirements to scan for indicators of compromise and ensure no persistent backdoors were established.
Detection Guidance
"Detection should focus on monitoring the SonicWall Appliance Management Console (AMC) for anomalous activity. Audit logs for the execution of unexpected system commands or the presence of shell metacharacters in administrative inputs. Security teams should also inspect network traffic for unauthorized outbound connections originating from the SMA appliance, which could indicate a reverse shell. Use endpoint detection tools to flag suspicious child processes spawned by the web server process on the appliance."