SonicWall is telling customers that patching its SMA 1000 remote access appliances will not be enough. On September 1, 2026 the vendor disclosed two flaws in the boxes companies use to give staff a way into internal systems from outside the office, and confirmed both are already being exploited in real attacks.
The more serious of the two, CVE-2026-83548, carries a CVSS score of 10.0, the maximum the scale allows. It is an unauthenticated server-side request forgery flaw, which means an attacker who has never logged in can make the appliance itself issue requests on their behalf. In SonicWall's own words, quoted by the Sophos Counter Threat Unit, that lets an attacker "gain unauthorized access to sensitive functionality and perform unauthorized operations".
The second, CVE-2026-83549, is scored 7.8. It is an OS command injection weakness in the Appliance Management Console that, in specific conditions, would "enable a remote attacker authenticated as an administrator to execute arbitrary OS commands, resulting in remote code execution".
Nobody has said whether the two can be chained
That is the question every defender will ask, and right now it is unanswered. France's national cyber agency ANSSI, which raised alert CERTFR-2026-ALE-009 on September 2, notes plainly that SonicWall did not specify whether an unauthenticated attacker can chain the two bugs together to take over the appliance outright. Nobody should assume they cannot.
A short list of boxes, and two version numbers
The affected models are the SMA1000 6210, 7210 and 8200v. According to CERT-FR's breakdown of the vendor advisory, the fixed builds are 12.5.0-02952 for the 12.5.x line and 12.4.3-03526 for anything older. SonicWall's own notice, SNWLID-2026-0016, is where the patches live.
Rebuild the appliance, rotate every password
Here is what separates this from a routine patch cycle. SonicWall's guidance, as relayed by CERT-FR, is that applying the fix is not sufficient on its own. The vendor recommends reinstalling the system, changing all user and administrator passwords, and resetting time-based one-time password (TOTP) seeds. That is the advice a vendor gives when it has concluded attackers may already be resident, and it is a far heavier lift than a firmware update: in practice it means treating any exposed appliance as compromised until you have proven otherwise.
Indicators of compromise are not being published openly either. CERT-FR says organizations have to contact SonicWall technical support to obtain them, which will slow down anyone trying to check their own logs this week.
The same product line, twice in two months
SMA 1000 appliances were already the subject of a CISA warning in July over a separate pair of actively exploited flaws. Internet-facing remote access gateways sit in exactly the position an intruder wants: reachable from anywhere, and trusted by everything behind them.
The disclosure was published by SonicWall's PSIRT as SNWLID-2026-0016 and written up by the Sophos Counter Threat Unit research team, with ANSSI's CERT-FR issuing a national alert the following day. If one of these appliances faces the internet in your estate, the vendor's own position is that you are past the point where patching alone answers the question.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.