SonicWall Issues Emergency Hotfix as Attackers Exploit Two Zero-Day VPN Vulnerabilities

Cybersecurity hardware and software provider SonicWall has issued an urgent advisory to enterprise customers worldwide following the discovery of active zero-day exploitation targeting its Secure Mobile Access (SMA) 1000 series VPN appliances. The vendor confirmed that malicious actors are taking advantage of two critical security flaws, tracked as CVE-2026-83548 and CVE-2026-83549, to breach enterprise edge networks. The primary flaw, CVE-2026-83548, carries a maximum severity CVSS score of 10.0 and exists as a pre-authentication Server-Side Request Forgery (SSRF) vulnerability within the appliance WorkPlace interface. This security hole allows an unauthenticated remote attacker to gain unauthorized access to sensitive internal functionality. When combined with CVE-2026-83549—a post-authentication operating system command injection flaw in the Appliance Management Console rated at 7.8—attackers can effectively chain both bugs together to achieve unauthenticated remote code execution with elevated administrative privileges. The affected systems include the SMA 6210, 7210, and 8200v physical and virtual models running outdated firmware versions. SonicWall has released emergency platform hotfixes (versions 12.4.3-03526 and 12.5.0-02952) and strongly urged system administrators to deploy the patches immediately. Organizations suspecting potential compromise have been advised to re-image or re-deploy affected units, reset all administrator and user credentials, and regenerate time-based one-time password (TOTP) tokens to eliminate persistent access by threat actors.