SonicWall disclosed two vulnerabilities in its SMA1000 series VPN appliances on 1 September 2026, and CISA confirmed real-world attacks against them within 24 hours. If your company, or an MSP and IT provider you rely on, runs an SMA1000 appliance facing the internet, this is not a "patch it this sprint" item. It is a "check today" item.
The two flaws are CVE-2026-83548, a pre-authentication server-side request forgery bug rated CVSS 10.0, and CVE-2026-83549, a post-authentication command injection bug rated 7.8. On their own, each is serious. Chained together, they let an attacker with no credentials at all reach full remote code execution on the appliance. That is close to worst case for a VPN gateway: no password needed, no user interaction needed, and the payoff is a shell on the box sitting at your network's front door.
Why this one moved so fast
CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 2 September 2026, one day after SonicWall's advisory. KEV listings are reserved for vulnerabilities CISA has evidence are already being exploited, not theoretical risk. Rapid7 and SecurityWeek both reported active exploitation alongside the disclosure, which is why the sensible timeline here compresses from "get to it this month" to "today."
What makes SMA1000 appliances worth targeting
SMA1000 series appliances are enterprise remote-access VPN gateways, the kind of box a growing company deploys so staff can reach internal systems from outside the office. That's exactly why they attract attackers: they sit directly on the network perimeter, they're built to be reachable from the public internet, and by design they carry elevated trust once a session is established. A working exploit chain against one doesn't land an attacker on some peripheral system. It lands them on the appliance that mediates access to everything behind it.
What to do today
Start by checking whether you're exposed at all. Ask your IT team or MSP directly: do we run an SMA1000 appliance, and is its management or user-access interface reachable from the public internet? Many organisations expose these because remote access is the whole point, but some restrict access behind an additional VPN layer or an IP allowlist. If yours already does, your exposure window is smaller, though you should still patch.
Second, apply SonicWall's fix per advisory SNWLID-2026-0016 immediately. Don't wait for a scheduled maintenance window. A CVSS 10.0 pre-auth SSRF chained to command injection, already confirmed exploited in the wild, is the exact scenario maintenance windows exist to be broken for.
Third, check logs for signs of exploitation rather than assuming patching alone resolves it. Rapid7's analysis describes the chain as SSRF followed by command injection, so look for unusual outbound requests originating from the appliance itself, a hallmark of SSRF abuse, followed by unexpected process execution or configuration changes. If the appliance isn't logging to a system you can actually review, turn that on now regardless of what you find, because the next disclosure won't announce itself in advance either.
Fourth, if the appliance doesn't strictly need to face the internet, this is a good moment to make that change permanent rather than reverting to the same exposure once this incident passes. Reaching it through a separate always-on VPN, a zero-trust proxy, or a tight IP allowlist closes off this entire class of pre-auth attack, not just this pair of CVEs.
The broader lesson
This isn't the first time a remote-access VPN appliance has been the entry point for a major compromise, and it won't be the last. These devices are attractive precisely because of what makes them useful: internet-facing by default, high privilege on the internal network, and often patched less frequently than routine servers because touching them risks cutting off remote staff mid-shift. That combination makes them a recurring target across vendors, not a problem unique to SonicWall. Whatever remote-access appliance your organisation runs, from whichever vendor, it's worth asking the same three questions this incident raises: does it need to face the internet, is it on the latest patch, and would you actually notice if it were being abused right now.
The bottom line
Two SonicWall SMA1000 vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained into unauthenticated remote code execution, and CISA confirmed active exploitation the day after disclosure. Patch per SonicWall's advisory today, and check whether the appliance needs to face the internet at all.