Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-83549

Published 2026-09-01

Updated last month

Vendor/s

SonicWall

Product/s

SMA1000 Appliances

Version/s

\* > 12.4.3-03526

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

7.8

/ 10

High

Severity Details

Base score

7.8 High

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-83549 is a high-severity RCE vulnerability in SonicWall SMA1000 appliances. Actively exploited; update firmware to prevent command injection.

## Why this matters

"CVE-2026-83549 is a high-severity OS command injection vulnerability affecting SonicWall SMA1000 series appliances. While the attack vector is classified as local and requires administrative authentication, this vulnerability is currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation by threat actors. If successfully exploited, an attacker can execute arbitrary OS commands with elevated privileges, leading to full remote code execution (RCE). This poses a significant risk to organizational infrastructure, as compromised SMA appliances can serve as a gateway for lateral movement or persistent access within a secure network environment."

## CPE

SonicWall

| Product           | Version Start | Version End (excl.) | Status     |
| ----------------- | ------------- | ------------------- | ---------- |
| sma8200v          | \*            | 12.4.3-03526        | vulnerable |
| sma8200v          | 12.5.0        | 12.5.0-02952        | vulnerable |
| sma8200v          | -             | -                   | unaffected |
| sma6210\_firmware | \*            | 12.4.3-03526        | vulnerable |
| sma6210\_firmware | 12.5.0        | 12.5.0-02952        | vulnerable |
| sma6210           | -             | -                   | unaffected |
| sma7210\_firmware | \*            | 12.4.3-03526        | vulnerable |
| sma7210\_firmware | 12.5.0        | 12.5.0-02952        | vulnerable |
| sma7210           | -             | -                   | unaffected |

## Related weakness (CWE)

CWE-78

## Remediation plan

1

### Apply official patches

Immediately download and install the security patches provided by SonicWall for the SMA1000 series. Refer to SonicWall advisory SNWLID-2026-0016 for specific patch instructions for SMA 6210, 7210, and 8200v platforms.

2

### Update affected systems

Ensure all SMA1000 appliances are updated to firmware versions 12.4.3-03526 or 12.5.0-02952 and above. Verify that no legacy or unpatched virtual appliances (SMA 8200v) remain active in the environment.

3

### Restrict access

Limit access to the Appliance Management Console (AMC) to authorized administrative personnel only via a management VLAN or VPN. Enforce strict Multi-Factor Authentication (MFA) for all administrative accounts to prevent unauthorized access.

4

### Monitor for exploitation

Review system logs for unusual shell command activity or unauthorized changes to the appliance configuration. Follow CISA’s Forensics Triage Requirements to scan for indicators of compromise and ensure no persistent backdoors were established.

## Detection Guidance

"Detection should focus on monitoring the SonicWall Appliance Management Console (AMC) for anomalous activity. Audit logs for the execution of unexpected system commands or the presence of shell metacharacters in administrative inputs. Security teams should also inspect network traffic for unauthorized outbound connections originating from the SMA appliance, which could indicate a reverse shell. Use endpoint detection tools to flag suspicious child processes spawned by the web server process on the appliance."

## References

[https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 Vendor Advisory ](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-83549 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)