Two SonicWall Zero-Days Are Being Actively Exploited—What Every Remote-Access Setup Needs to Know

Table of Contents

• 1. The Two Flaws Behind the Urgency
• 2. A CVSS 10.0 Score Doesn't Happen Often
• 3. From SSRF to Command Injection: How the Chain Works
• 4. What "Actively Exploited" Actually Means Here
• 5. Why CISA's KEV Listing Changes the Clock
• 6. The Other Five Vulnerabilities Riding Along
• 7. Why VPN Appliances Keep Ending Up in This Position
• 8. What Organizations Should Do This Week
• 9. Building the Skills to Catch This Before CISA Does — Innovative Academy
• 10. Final Thoughts

Every organization running remote access has some version of the same appliance quietly sitting at its network edge, trusted almost by default because it's "just" infrastructure that's supposed to keep bad traffic out.

That assumption was proven wrong in early September 2026, when CISA confirmed that two vulnerabilities in SonicWall's SMA 1000 series appliances—widely used for secure remote access—were being actively exploited in the wild, with attackers already using them to deploy reverse shells on compromised systems.

For security teams, this isn't simply another vulnerability announcement. It's a reminder that internet-facing infrastructure can become the shortest path into an otherwise protected network.

1. The Two Flaws Behind the Urgency

The vulnerabilities are CVE-2026-83548 and CVE-2026-83549, both affecting SonicWall's SMA 1000 series appliances—hardware and software many organizations rely on to let employees connect securely to internal systems from outside the office.

CVE-2026-83548 is a server-side request forgery (SSRF) flaw that allows a remote, entirely unauthenticated attacker to gain unauthorized access to sensitive backend functionality.

CVE-2026-83549 is a post-authentication OS command injection vulnerability. It can allow an attacker who already has administrator-level access to execute arbitrary commands directly on the underlying operating system.

Individually, each vulnerability is dangerous. Chained together, they become considerably more serious because one flaw can potentially help an attacker overcome the access requirements of the other.

2. A CVSS 10.0 Score Doesn't Happen Often

CVE-2026-83548 carries a CVSS score of 10.0—the maximum possible severity rating.

That reflects an assessment that the flaw is remotely exploitable, requires no authentication, and can potentially result in a complete compromise of confidentiality, integrity, and availability.

CVE-2026-83549 scores a still-serious 7.8. It requires prior administrative access but provides arbitrary command execution once that barrier is cleared.

When two serious vulnerabilities affect the same product line and are disclosed together, security teams should immediately consider whether the vulnerabilities can be chained rather than evaluating each one in isolation.

3. From SSRF to Command Injection: How the Chain Works

The practical danger isn't just two separate bugs—it's how naturally they can combine.

An SSRF vulnerability tricks a server into making requests on an attacker's behalf. Depending on the vulnerable application's architecture, this can expose internal services or functionality that shouldn't be directly reachable from the internet.

On its own, that's a serious access-control failure.

But when an SSRF flaw exists in the same appliance as a command injection vulnerability requiring administrator access, the situation becomes significantly more dangerous. If the attacker can use the first weakness to reach or obtain the required privileged functionality, the second flaw may provide a path toward arbitrary command execution.

The broader security lesson is important: vulnerabilities should not always be assessed independently. Two medium-to-critical weaknesses can sometimes create a much more severe attack chain when combined.

4. What "Actively Exploited" Actually Means Here

SonicWall's disclosure did not describe these vulnerabilities as theoretical risks. The company confirmed active exploitation in the wild, meaning attackers were already using the vulnerabilities against real targets before widespread remediation could take place.

Threat actors were observed using the vulnerabilities to deploy reverse shells.

A reverse shell is a technique in which a compromised system establishes an outbound connection to an attacker-controlled system and provides an interactive command-line session. This can give an attacker a remote foothold on the compromised machine.

For a remote-access appliance, that foothold is particularly concerning because the device sits at the boundary between the public internet and internal infrastructure.

That's the difference between "this could theoretically be abused" and "attackers are actively abusing it."

Once exploitation is confirmed, organizations need to move from vulnerability management to incident-response thinking.

5. Why CISA's KEV Listing Changes the Clock

CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog around September 2–3, 2026.

For U.S. federal civilian agencies, a KEV listing can trigger a specific remediation deadline under the applicable federal directive.

Even for organizations outside that mandate, a KEV listing is one of the clearest signals that a vulnerability should receive immediate attention. It indicates that exploitation has been confirmed rather than merely predicted.

For security teams, the practical message is simple:

• Do not treat the vulnerability as a routine patching task.
• Determine whether affected appliances exist in your environment.
• Check whether exposed systems have already been targeted.
• Patch or mitigate as quickly as operationally possible.
• Review logs and network activity for signs of compromise.

In other words, once a vulnerability enters the KEV catalog, "patch when convenient" is no longer an appropriate risk-management strategy.

6. The Other Five Vulnerabilities Riding Along

SonicWall's vulnerabilities were not listed in isolation. They were part of a broader batch of vulnerabilities added around the same period, spanning products and technologies including JFrog Artifactory, Sangoma Switchvox, Kestra, Starlette, and Berri LiteLLM.

That breadth is an important security lesson.

Actively exploited vulnerabilities can emerge across completely different parts of the technology stack at the same time—developer tools, VoIP platforms, workflow engines, web frameworks, AI infrastructure, and network security appliances.

Security teams therefore need visibility across their entire technology environment rather than monitoring only the product category currently receiving the most attention.

7. Why VPN Appliances Keep Ending Up in This Position

This isn't the first time a remote-access appliance has ended up at the center of an actively exploited vulnerability story, and it won't be the last.

VPN and secure-access gateways have several characteristics that make them attractive targets:

• They are intentionally exposed to the internet.
• They frequently provide privileged access to internal resources.
• They sit at a critical network boundary.
• They often contain authentication and session information.
• Compromise can provide attackers with a trusted foothold.

From the network's perspective, traffic originating from a compromised remote-access appliance may look much more legitimate than traffic coming directly from an unknown external host.

Combine that trusted position with appliances that may operate for years without close security review, and you have an attractive target.

An attacker with a foothold on such a gateway could potentially use its network position to investigate internal systems, steal credentials, move laterally, or maintain persistence.

This is why edge infrastructure deserves the same security attention as applications and databases behind it.

8. What Organizations Should Do This Week

The response isn't complicated, even if it needs to happen quickly.

1. Identify affected appliances

Determine whether your organization operates SonicWall SMA 1000 appliances or affected software versions. Include production, backup, disaster-recovery, and less-visible infrastructure.

2. Apply the vendor's security update

Install the fixed firmware or software version recommended by SonicWall as soon as operationally possible.

3. Review logs

Look for suspicious requests, unusual administrator activity, unexpected authentication events, and indicators associated with reverse-shell activity.

4. Investigate outbound connections

Unexpected outbound connections originating from an internet-facing security appliance should receive immediate investigation, particularly connections to unfamiliar external infrastructure.

5. Audit administrator accounts

Review privileged accounts for unexpected logins, recently created accounts, password changes, or other suspicious administrative activity.

6. Restrict exposure if patching is delayed

If an affected system cannot be patched immediately, consider temporarily restricting external access to management interfaces and reducing exposure wherever operationally possible.

That inconvenience is considerably smaller than leaving a maximum-severity, unauthenticated vulnerability exposed on internet-facing infrastructure.

Organizations should also consider reviewing their broader network security knowledge and incident-response capabilities so teams can identify suspicious traffic and understand how compromised edge devices can affect internal networks.

9. Building the Skills to Catch This Before CISA Does — Innovative Academy

Responding effectively to a story like this requires more than following a patch checklist.

Security professionals need to understand how vulnerabilities such as SSRF and command injection work, how attackers chain weaknesses together, and how network logs and traffic patterns can reveal suspicious activity.

That's where practical, hands-on security training becomes valuable.

Innovative Academy's Azure Security course in Bangalore focuses on security concepts including threat protection, security monitoring, identity and access control, and cloud security architecture.

For students and IT professionals looking to build a stronger foundation in networking and security, CCNA training can also help develop practical knowledge of network infrastructure, routing, switching, access control, and troubleshooting.

Security incidents like this demonstrate why cybersecurity professionals need to understand both network infrastructure and security operations. Knowing how traffic moves through a network makes it easier to recognize when that traffic doesn't look normal.

10. Final Thoughts

Some people will tell this story as "SonicWall had a bad month." That framing misses the more useful lesson.

A maximum-severity, unauthenticated SSRF flaw paired with a command-injection vulnerability in the same product line—and actively exploited before CISA's intervention—illustrates what can happen when internet-facing infrastructure doesn't receive the same ongoing scrutiny as the applications running behind it.

The interesting part isn't simply that a vulnerability existed.

It's the chain.

An unauthenticated access-control weakness and a post-authentication execution vulnerability can become dramatically more dangerous when they exist within the same trusted piece of infrastructure.

And CISA's KEV catalog exists for a reason: organizations cannot afford to wait until every vulnerability becomes a headline before taking action.

The organizations that come out of incidents like this relatively unscathed are usually the ones that already have visibility into their edge infrastructure, know what they have deployed, monitor it continuously, and can move quickly when exploitation is confirmed.

For anyone building a career in cybersecurity, the lesson is equally valuable: understanding how attacks work is just as important as knowing that a vulnerability exists.

Because when the next zero-day hits, the difference between being compromised and being prepared may come down to how quickly you can recognize the attack chain.