Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
SonicWall reported active exploitation of two vulnerabilities in its SMA 1000 appliances in a notice dated September 1, 2026: CVE-2026-83548 and CVE-2026-83549. The notice confirms exploitation, but the available dates do not establish exactly how many days separated the first exploitation from public disclosure. A separate July 2026 incident involved CVE-2026-15409 and CVE-2026-15410, so check the CVE numbers before applying fixes or assessing exposure.
Which SonicWall vulnerabilities were being exploited?
The most recent episode covered here is SonicWall’s September 1, 2026 notice for the SMA 1000 series. It identifies two actively exploited vulnerabilities:
- CVE-2026-83548: A pre-authentication server-side request forgery (SSRF) flaw involving an unintended forward proxy. SonicWall assigned it CVSS 10.0 (Critical).
- CVE-2026-83549: A post-authentication remote code execution (RCE) vulnerability. SonicWall assigned it CVSS 7.8 (High).
These scores describe assessed severity, not the number of victims or the likelihood that a particular appliance was compromised. SonicWall’s September 1 product notice is the reference for its vulnerability descriptions, affected releases and remediation.
Do not confuse the September issue with the July incident
SonicWall SMA 1000 appliances were also the subject of a distinct July incident. The Cyber Security Agency of Singapore (CSA) reported on July 15, 2026 that attackers were exploiting CVE-2026-15409 and CVE-2026-15410. The two episodes have different CVE pairs and patch versions.
#1 Best Overall
- SonicWall Firewall SSL VPN - License (01-SSC-8629)
- Secure Remote User Access: Enables encrypted VPN connections to SonicWall firewalls for users working from home, on the road, or at branch locations.
- Clientless Browser-Based VPN: Users can securely access internal resources through web browsers without requiring a dedicated VPN client.
- Policy-Based Access Controls: Enforce granular access by user, device, time, or application with full integration into LDAP, AD, or RADIUS.
- Supports Windows, macOS, and Mobile Devices: Ensure secure access across diverse platforms, including laptops, tablets, and smartphones.
| Incident | Vulnerabilities and impact | Product scope and fix information |
|---|---|---|
| September 2026 | CVE-2026-83548: pre-auth SSRF, CVSS 10.0 (Critical). CVE-2026-83549: post-auth RCE, CVSS 7.8 (High). SonicWall reported both actively exploited. | SMA 1000 models 6210, 7210 and 8200v. Affected platform hotfixes: 12.4.3-03453 and 12.5.0-02835. Listed fixed versions: 12.4.3-03526 and 12.5.0-02952. Source: SonicWall. |
| July 2026 | CVE-2026-15409: unauthenticated SSRF in the Appliance Work Place interface, CVSS v3.1 10.0. CVE-2026-15410: code injection in the Appliance Management Console that could let a remotely authenticated administrator run operating-system commands, CVSS v3.1 7.2. CSA reported exploitation. | CSA directed users to 12.4.3-03453 or 12.5.0-02835, or later releases. The Canadian alert listed affected versions 12.4.3-03245, -03387, -03434 and 12.5.0-02283, -02624, -02800. Sources: CSA and Canadian Centre for Cyber Security. |
The Canadian Centre for Cyber Security reported that CISA added the July CVEs to its Known Exploited Vulnerabilities (KEV) catalog on July 14, 2026, and the September CVEs on September 2, 2026. KEV inclusion records a catalog listing; it is not a count of affected organizations.
Which SMA 1000 versions are affected?
For the September vulnerabilities, SonicWall names SMA 1000 models 6210, 7210 and 8200v across hypervisors. Its notice lists platform-hotfix versions 12.4.3-03453 and 12.5.0-02835 as affected, with 12.4.3-03526 and 12.5.0-02952 as fixed. These are the September notice’s version details; do not treat the July advisory’s affected-version list as the September list.
Rank #2
- HIGH AVAILABILITY UNIT: Secondary appliance for active/standby stateful failover; requires a matching primary firewall. Hardware only — security services and support are not included.
- PERFORMANCE: Up to 8 Gbps firewall inspection, 6 Gbps threat prevention and 5.5 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 16x1GbE + 3x10G SFP+ in a 1U rack-mount form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR MID-SIZE ENTERPRISE: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
Check the appliance’s exact model and installed platform-hotfix version, then compare them with the current SonicWall notice. Confirm the current fixed release and support instructions with SonicWall before making changes; version guidance can be updated.
How to respond if your appliance may be exposed
- Identify the appliance and release. Confirm whether the deployment is an SMA 1000 model 6210, 7210 or 8200v and record its installed platform-hotfix version.
- Apply the vendor’s current fix. Follow SonicWall’s current instructions to upgrade an affected appliance to the latest hotfix. The September notice lists 12.4.3-03526 and 12.5.0-02952 as fixed versions.
- Request an indicator-of-compromise review. SonicWall directs affected organizations to contact Technical Support for help reviewing indicators of compromise (IoCs).
- If IoCs are found, follow the vendor’s recovery steps. SonicWall recommends re-imaging hardware appliances or redeploying virtual appliances, changing all user and administrator passwords, and resetting TOTP tokens.
Applying a hotfix addresses the vulnerable software, but it is not a substitute for the additional recovery steps SonicWall specifies if compromise indicators are present.
Rank #3
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP + 802.11ax Wi-Fi in a desktop form factor; integrated 802.11ax (Wi-Fi 6) wireless; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
Does this affect SonicWall firewalls or SMA 100 appliances?
For the July CVE-2026-15409 and CVE-2026-15410 incident, CSA explicitly said SSL-VPN running on SonicWall firewalls and the SMA 100 Series were not affected. That exclusion is specific to the July advisory; it should not be assumed to define the scope of the separate September vulnerabilities. Check SonicWall’s September notice for the product scope of CVE-2026-83548 and CVE-2026-83549.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Was my SonicWall SMA 1000 hacked?
Active exploitation means attackers used the vulnerabilities against some targets; it does not establish that any particular appliance was accessed. Affected model and version information can identify exposure, but determining whether an installation was compromised requires reviewing its indicators. For the September incident, SonicWall directs customers to Technical Support for IoC review and provides additional recovery actions if indicators are found. The cited notices do not provide a victim count.
Quick Recap
Best Value
- SonicWall Global VPN Client - License (01-SSC-5311)
- Secure IPsec VPN Access: Enables encrypted remote connections to SonicWall firewalls using robust IPsec tunneling protocols.
- Consistent Remote Access Experience: Delivers a reliable and high-performance VPN connection for employees working remotely or from branch sites.
- Compatible with Windows OS: Designed for Microsoft Windows environments, with simple installation and configuration.
- Policy-Based Access Control: Enforce connection rules and restrict access to resources based on user identity and endpoint status.
Rank #4
- SonicWall NSa2700 Appliance Only - No Service Subscription (02-SSC-8897) - Built for mid-sized enterprises, delivering strong multi-gigabit throughput and high connection counts to secure evolving networks without sacrificing performance.
- Blocks ransomware and zero-day malware using Capture ATP sandboxing with patented RTDMI memory inspection, plus IPS and anti-malware for layered defense.
- Flexible connectivity options with multiple 1 GbE and 10 GbE SFP+ interfaces support scalable, future-ready deployments across campus and branch networks.
- Supports large remote access and site connectivity with extensive VPN and ZTNA capabilities to enable hybrid work and secure private app access.
- The SonicWall Secure Upgrade Program allows customers to trade in any existing SonicWall or third-party firewall for a new SonicWall Gen 7 appliance at a reduced cost. Includes eligibility for matching service subscriptions, helping organizations modernize outdated security infrastructure, simplify renewals, and ensure continued protection with the latest performance and threat defense technologies.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
