SonicWall Patches Two VPN Zero-Days Already Being Used by Hackers
A perfect-10 flaw in SonicWall's SMA 1000 remote-access boxes lets attackers slip past the login screen, and it's being paired with a second bug in real attacks.
Key points
- SonicWall issued emergency fixes for two flaws in its SMA 1000 series VPN appliances, kit that lets staff log into company networks remotely.
- One bug, CVE-2026-83548, scores the maximum 10.0 on the industry severity scale and requires no password to exploit.
- Both flaws are already being used in live attacks, per SonicWall's own advisory.
- The bugs were found internally by SonicWall researchers William Perry and Adam Babis.
- Administrators should patch today; the SMA 1000 line is widely used by mid-sized companies and government agencies.
SonicWall has shipped fixes for two serious flaws in its Secure Mobile Access 1000 appliances, the boxes businesses use to give remote workers a secure tunnel into the office network. The vendor confirms both are being exploited now, not theoretically.
CVE-2026-83548 scores a 10.0 on the CVSS scale, the standard 0-to-10 severity rating used across the industry. The flaw is a pre-authentication server-side request forgery (SSRF): an unauthenticated attacker can trick the appliance into making network requests on their behalf without supplying any credentials. A 10.0 pre-auth bug on a VPN gateway is a drop-everything problem. This is the third SonicWall SMA 1000 story we've covered since July, following ransomware crews exploiting a separate maximum-severity bug while hundreds of unpatched appliances remained internet-facing as of 10 August.
The second vulnerability has not been detailed publicly. SonicWall says the two can be chained: one opens the door, the other walks through it. William Perry and Adam Babis, both SonicWall researchers, found both flaws internally. The disclosure was first reported by The Hacker News.
What is actually affected?
The SMA 1000 series only. These are the higher-end remote-access appliances SonicWall sells to larger organisations. The smaller SMA 100 line, common in small businesses, is a separate product with its own patch cycle and is not named in this advisory.
| Detail | Value |
|---|---|
| Lead CVE | CVE-2026-83548 |
| CVSS score | 10.0 (critical) |
| Flaw type | Pre-auth SSRF |
| Affected product | SonicWall SMA 1000 series |
| Exploited in the wild | Yes, per vendor |
| Credited researchers | William Perry, Adam Babis (SonicWall) |
Should ordinary users be worried?
Not directly, but your employer might be. If your company uses a SonicWall VPN for remote access, the IT team needs to patch quickly. For everyone else, this is a corporate infrastructure problem, not something sitting on your phone or laptop.
Breaking the front door of a remote-access appliance typically puts an attacker inside the corporate network with a useful vantage point. That's exactly why this class of flaw gets treated as urgent.
What should administrators do now?
Apply the SonicWall update for the SMA 1000 series today, not at the next maintenance window. Then audit appliance logs for signs of exploitation going back several weeks: zero-day means attackers had a head start before the patch existed.
If immediate patching isn't possible, restrict the management interface to known IP addresses and take the appliance off the public internet where feasible. SonicWall's advisory carries the exact fixed versions and any interim mitigations.
Expect public exploit code within days. It usually follows once a 10.0 pre-auth bug is confirmed exploited in the wild.
