SonicWall Fixes OS Command Injection Flaw CVE-2026-83549 in SMA1000 Series

SonicWall has patched an OS command injection flaw in its Secure Mobile Access 1000 Series appliances. Tracked as CVE-2026-83549, the SonicWall SMA1000 Appliances OS Command Injection Vulnerability carries a CVSS v3.1 score of 7.8 and enables an authenticated administrator to execute arbitrary commands on the underlying operating system.

Vulnerability Breakdown

The flaw stems from improper neutralization of special elements in administrative commands (CWE-78) within the appliance’s management interface. Under the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, the exploit path requires low-privilege administrative access or local interface reachability. However, once triggered, it bypasses restricted management menus to execute arbitrary shell commands with root privileges host-wide.

Edge gateways like the SMA1000 series sit on the perimeter, making post-authentication remote code execution flaws particularly valuable to advanced threat actors. If an attacker compromises administrator credentials through credential stuffing, phishing, or session hijacking, CVE-2026-83549 allows them to turn appliance access into full host persistence, extract active VPN session keys, or pivot directly into internal subnet segments. The current Exploit Prediction Scoring System (EPSS) score sits at 0.92% (57.8th percentile), signaling that while broad automated scanning remains low, the asset type remains a target for focused intrusion campaigns.

Affected Platforms

The weakness affects both physical and virtual deployments across the SMA1000 product family on legacy 12.4.3 and 12.5.0 release tracks:

• SMA 8200v: Versions prior to 12.4.3-03526, and 12.5.0 versions prior to 12.5.0-02952
• SMA 6210: Firmware versions prior to 12.4.3-03526, and 12.5.0 versions prior to 12.5.0-02952
• SMA 7210: Firmware versions prior to 12.4.3-03526, and 12.5.0 versions prior to 12.5.0-02952

Remediation and Response

SonicWall addressed this vulnerability in advisory SNWLID-2026-0016. System administrators should immediately update SMA1000 devices to firmware version 12.4.3-03526 or 12.5.0-02952 based on their active release branch.

Organizations subject to CISA BOD 26-04 mandate remediation by September 5, 2026. Beyond applying firmware updates, administrators should ensure the SMA management console is not exposed directly to the public internet and is accessible only from isolated management subnets or jump hosts behind strict access controls.