Two SonicWall Zero-Days Are Being Exploited Right Now: What You Need to Know

Michael Miller · 2026-09-02

SonicWall just dropped an urgent security advisory, and if you're running their SMA 1000 series VPN appliances, you'll want to stop what you're doing and read this. The company has confirmed that two critical vulnerabilities are actively being exploited in the wild, and they might even work together as part of a larger attack chain. These aren't theoretical flaws sitting in a lab somewhere. These are real, live zero-days that attackers have already weaponized. That changes the urgency level from "patch soon" to "patch yesterday." ### The Two Flaws at the Heart of the Matter SonicWall's internal security team, specifically William Perry and Adam Babis, discovered both vulnerabilities. Here's what they found: - **CVE-2026-83548 (CVSS score: 10.0):** This is a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the appliance. A perfect 10 on the CVSS scale means this is about as severe as it gets. An attacker doesn't need any credentials to exploit it, and it could let them make the appliance send requests to internal resources it shouldn't be touching. Now, here's the part that should really grab your attention. A CVSS score of 10.0 is incredibly rare. When you see that number, you're looking at a vulnerability that requires no authentication, no user interaction, and likely has a critical impact on confidentiality, integrity, and availability. This isn't a minor misconfiguration issue. ### Why the Attack Chain Theory Matters Security researchers are particularly concerned that these two flaws could form what's known as an attack chain. In simple terms, an attacker might use one vulnerability to gain an initial foothold, then leverage the second one to move deeper into your network or escalate their privileges. Think of it like a burglar first picking your front door lock, then using a master key they find inside to access every room in the house. When vulnerabilities can be chained together, the risk multiplies. A single flaw might be concerning, but two that work in tandem can give attackers a clear path from the internet all the way to your most sensitive internal systems. That's the nightmare scenario for any security team. ### What SonicWall Is Doing About It The good news is that SonicWall has already released security updates to address both issues. They didn't wait around or try to hide the problem. The patches are available now, and the company is urging all customers to apply them immediately. If you're responsible for managing these appliances, here's what you should be doing right now: 1. **Check your version** against the patched releases listed in SonicWall's advisory. 2. **Apply the update** as soon as possible, ideally during a maintenance window if you can't do it immediately. 3. **Review your logs** for any suspicious activity that might indicate you've already been targeted. 4. **Segment your network** to limit the blast radius if an attacker did manage to exploit these flaws before you patched. ### The Bigger Picture for VPN Security This incident serves as another reminder that VPN appliances are prime targets for attackers. They sit at the edge of your network, exposed to the internet, and they hold the keys to your internal resources. When a vendor like SonicWall discovers zero-days in these devices, it's not just their problem. It's a problem for every organization that relies on remote access. We've seen this pattern play out with other VPN vendors over the years, and the lesson is always the same: patch management isn't optional, it's a survival skill. If you're running any type of edge device, make sure you have a process in place to monitor vendor advisories and deploy critical updates within days, not weeks or months. ### Final Thoughts This is a serious situation, but it's also a manageable one if you act quickly. The patches are out, the details are public, and now it's up to you to protect your network. Don't assume your organization is too small to be a target or too large to be compromised. Attackers don't discriminate based on size. Take a few minutes today to check your SonicWall SMA 1000 appliances, apply the necessary updates, and verify that your security monitoring is picking up the right signals. A little proactive effort now could save you from a major incident down the road. Stay safe out there, and remember that in the world of cybersecurity, complacency is the real vulnerability.