7.8

CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability

CVSS: 7.8v3.1HighKEVAnalyzed
Published 01-09-2026Last modified 21-09-2026
Open JSON

Vulnerability summary

CVE-2026-83549 is a high (CVSS 7.8) OS Command Injection vulnerability in SonicWall SMA1000 Appliances. It is known to be exploited: CISA lists it, first on 02-09-2026. EPSS estimates a 9.89% chance of exploitation in the next 30 days, higher than 95.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
9.89%
0%100%
Low · +1.38 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits1metasploit

Timeline

  1. 01-09-2026
    PublishedVulnerability first disclosed.
  2. 02-09-2026
    Added to CISA KEVSonicWall SMA1000 Appliances OS Command Injection Vulnerability
  3. 05-09-2026
    CISA remediation dueApply mitigations per vendor instructions.
  4. 21-09-2026
    Last modifiedVulnerability information updated.

Description

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

9.89%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

+1.38 pp

From 8.51% on 18-09-2026

18-09-202618-10-2026
EPSS score
9.89%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
02-09-2026
Federal due date
05-09-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 nvd.nist.gov/vuln/detail/CVE-2026-83549

Public exploits

1 found
  • MetasploitMetasploitremoteVerified

    SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution

    exploit/linux/http/sonicwall_sma1000_couchdb_rce

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Sonicwall4 products
  • sma1000_firmware12.4.3-03453 (platform-hotfix) and older versions | 12.5.0-02835 (platform-hotfix) and older versions
  • sma6210_firmware< 12.4.3-03526 | ≥ 12.5.0, < 12.5.0-02952
  • sma7210_firmware< 12.4.3-03526 | ≥ 12.5.0, < 12.5.0-02952
  • sma8200v< 12.4.3-03526 | ≥ 12.5.0, < 12.5.0-02952

1 vendor · 4 products

References

2 links