CVE-2026-83549: SonicWall SMA1000 OS Command Injection Added to CISA KEV

TL;DR

CVE-2026-83549 is a post-authentication OS command injection flaw in the SonicWall SMA1000 Appliance Management Console (AMC) that lets an authenticated administrator execute arbitrary OS commands, resulting in remote code execution. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a remediation due date of 2026-09-05, so internet-facing SMA1000 appliances should be treated as urgent. Apply the vendor's fixed firmware or mitigations immediately, and perform forensic triage if compromise is suspected.

What is this vulnerability?

Field	Value
CVE	CVE-2026-83549
Vendor / Product	SonicWall / SMA1000 Appliances
Vulnerability name	SonicWall SMA1000 Appliances OS Command Injection Vulnerability
Weakness	CWE-78 (Improper Neutralization of Special Elements used in an OS Command)
CISA KEV added	2026-09-02
CISA KEV due date	2026-09-05
Known ransomware use	Unknown
Vendor advisory	SNWLID-2026-0016
CVSS v3.1 (Watchstack)	7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	0.08505 (percentile 0.94764)

Overview

CVE-2026-83549 is a post-authentication OS command injection vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC). The flaw is tracked as CWE-78, improper neutralization of special elements used in an OS command, and affects SMA1000 series appliances that are commonly deployed as internet-facing remote access gateways. SonicWall published its advisory under SNWLID-2026-0016, and CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a remediation due date of 2026-09-05. That three-day window is unusually short and signals that exploitation has been observed or is considered highly likely in the wild.

The affected product line includes SMA1000 appliances such as the SMA8200V, SMA7210, and SMA6210. Public reporting indicates that firmware versions prior to 12.4.3-03526 or 12.5.0-02952 are impacted, and SonicWall has released patched builds. Administrators should consult the SonicWall PSIRT advisory for the definitive list of fixed versions and any model-specific guidance, because the exact vulnerable ranges are best confirmed against the vendor's own documentation.

Severity signals are mixed but point in the same direction. NVD currently lists the severity as unknown, while Watchstack records a CVSS 3.1 base score of 7.8 (HIGH) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Wiz also rates the issue HIGH with a CVSS base of 7.8 and an EPSS percentile of 94.8. EPSS sits at roughly 0.085 with a percentile near 0.948, meaning the model places this well above the vast majority of scored CVEs. Defenders who operate SMA1000 appliances, especially those exposed to the internet or used for administrative access, should treat this as an urgent patch item and review the appliance for signs of prior compromise.

Technical details

The root cause is improper neutralization of special elements used in an OS command. In practical terms, the AMC passes attacker-influenced input into a shell or command execution context without sufficient escaping or allow-listing, allowing injected command separators or shell metacharacters to be interpreted by the underlying operating system. The vendor describes the issue as post-authentication and requiring administrator privileges, which places the trust boundary at the management console session rather than at the network edge.

Public research describes a multi-stage exploit chain in which CVE-2026-83549 is the final step. In that chain, an unauthenticated SSRF (CVE-2026-83548) is used to reach a loopback CouchDB instance, which is then leveraged via its Erlang native query server to execute shell commands as the couchdb account, recover local ctrl-service credentials, and finally invoke the sysCtrl.execCmsSnmpTrap XML-RPC method. The injected parameter reaches cmsSnmpTrap.sh as input to a sed -e "s^@SUBSTITUTE@^$2^" command; by injecting GNU sed's e flag with a base64-encoded payload, an attacker achieves root-level code execution. The CVSS attack vector is listed as Local, reflecting the post-authentication AMC context, but the full exploit chain is remotely triggerable over the network.

Attack prerequisites include a valid administrative session on the AMC and the ability to reach the management interface, either directly or through an exposed management plane. Because the flaw is post-authentication, credential compromise, session hijacking, or abuse of over-privileged accounts are realistic precursor conditions. The weakness class is well understood: any code path that concatenates user-controlled strings into a shell command, or that invokes a system utility with unsanitized arguments, is a candidate for this kind of injection.

• Affected models: SMA1000 series, including SMA8200V, SMA7210, and SMA6210.
• Affected firmware: versions prior to 12.4.3-03526 or 12.5.0-02952 (confirm against SonicWall PSIRT).
• Vulnerable component: SMA1000 Appliance Management Console (AMC).
• Network exposure: management console reachable over HTTPS; often internet-facing on remote access gateways.
• Authentication: post-authentication, administrator privileges required for direct exploitation; chained exploitation can begin unauthenticated via CVE-2026-83548.

Impact

Successful exploitation allows an authenticated administrator to execute arbitrary OS commands on the SMA1000 appliance, which is effectively remote code execution in the context of the appliance's operating system. Because SMA1000 devices sit at the remote access boundary, compromise can expose VPN or access-control configuration, authentication material, session data, and any secrets stored or cached on the appliance. Integrity impact is high: an attacker could alter appliance configuration, add or modify administrative accounts, adjust access policies, or plant persistence. Availability impact is also high, since an attacker with OS-level command execution could disrupt services, modify startup behavior, or render the appliance unusable.

When chained with CVE-2026-83548, the combined effect is complete, unauthenticated root-level remote code execution on the SMA1000 appliance. An attacker gains full control of the device, enabling credential theft (including MFA seeds), persistent backdoor installation, lateral movement into connected enterprise networks, and potential ransomware deployment. Because SMA1000 appliances serve as remote access gateways, compromise exposes all VPN-connected internal resources to the attacker.

Downstream abuse scenarios include using the appliance as a pivot into internal networks, harvesting credentials from connected sessions, or weakening authentication controls to enable broader intrusion. For defenders, the business exposure is significant: an internet-facing access gateway that is compromised can undermine the security assumptions for every user and service that relies on it. Even though the vulnerability requires administrator-level access, the combination of KEV listing and a short remediation window means organizations should assume active targeting and prioritize containment and forensic review.

Exploitability

CVE-2026-83549 was added to the CISA KEV catalog on 2026-09-02, which indicates that exploitation has been observed or is considered highly likely in the wild. The EPSS score of 0.08505 with a percentile of 0.94764 places this CVE well above the vast majority of scored vulnerabilities, reinforcing the need for urgent action. A public GitHub repository referencing CVE-2026-83548 and CVE-2026-83549 has circulated, which raises the likelihood of broader scanning and exploitation attempts.

Rapid7 published an emergency threat response blog post confirming in-the-wild exploitation and detailing the attack chain, and a Metasploit module for the SonicWall SMA1000 CouchDB RCE chain is publicly available. SonicWall issued an urgent advisory (SNWLID-2026-0016) warning of active exploitation and urging immediate patching. Sophos, eSentire, Qualys, and multiple national CERTs (Canada, Hong Kong, UK NHS, Thailand) issued advisories. Community discussion on Reddit highlighted frustration with recurring SMA1000 vulnerabilities, with some users noting this was the product's third significant compromise in a short period. Dark Reading and BleepingComputer covered the story prominently, emphasizing the chained unauthenticated RCE risk.

KEV vs CVSS vs EPSS

Signal	What it measures	Action for this CVE
CISA KEV	Confirmed in-the-wild exploitation	Treat as urgent; apply mitigations by 2026-09-05 and perform forensic triage per BOD 26-04.
CVSS v3.1 (7.8 HIGH)	Intrinsic severity of the vulnerability	Prioritize patching; high impact to confidentiality, integrity, and availability.
EPSS (0.08505, 94.8th percentile)	Probability of exploitation in the next 30 days	Elevate monitoring and patch priority; model places this well above most CVEs.

Exploitation steps (defensive triage)

1. Confirm whether the organization operates any SonicWall SMA1000 appliances and identify which of them expose the Appliance Management Console to untrusted networks.
2. Review authentication logs for the AMC to identify successful administrative logins from unusual source IPs, unexpected geographies, or atypical user agents.
3. Hunt for evidence of command injection attempts in web or application logs, focusing on requests to management endpoints that contain shell metacharacters such as semicolons, pipes, backticks, or command substitution syntax.
4. Correlate any suspicious AMC activity with subsequent OS-level process creation on the appliance, particularly shells or utilities spawned by the management service.
5. Check for unauthorized changes to appliance configuration, including new or modified administrative accounts, altered access policies, and unexpected scheduled tasks or startup entries.
6. Inspect outbound network connections from the appliance for signs of command-and-control, data exfiltration, or lateral movement toward internal hosts.
7. Preserve logs and volatile evidence before remediation, in line with CISA's forensics triage guidance, so that scope and dwell time can be established.
8. Apply the vendor-recommended fix or mitigation, rotate credentials and secrets that may have been exposed, and continue monitoring for re-compromise.

Indicators of compromise

• Network: Unusual OPTIONS requests to the SMA1000 WorkPlace HTTPS listener (port 443) with absolute-form URIs containing __EXTRAWEB__ or 127.0.0.1:5984 in the path/query; unexpected outbound connections from the appliance to attacker-controlled IPs; XML-RPC traffic on loopback TCP port 8188 originating from the couchdb process.
• File System: Unexpected modifications to /opt/couchdb/etc/local.d/local-settings.ini (e.g., appended [native_query_servers] section); presence of temporary or randomized CouchDB design documents (_design/<random>); new or modified scripts in the CouchDB or AMC directories; base64-encoded payloads in shell history or cron jobs.
• Process: Unusual child processes spawned by couchdb or ctrl-service (e.g., /bin/bash, curl, wget); sed processes with e-flag arguments containing base64-decoded content; processes running as root initiated from the couchdb account.
• Logs: CouchDB logs showing creation/deletion of design documents with randomized names; AMC logs recording sysCtrl.execCmsSnmpTrap XML-RPC calls with anomalous parameters; WorkPlace access logs with OPTIONS requests to unusual absolute-form URIs; evidence of INI file reload events.
• Authentication: Successful AMC logins from unfamiliar source IP addresses, especially outside normal administrative hours or geographies; authentication failures followed by a successful login from the same source, suggesting credential stuffing or brute force preceding exploitation.
• EDR / Behavioral: Alerts from EDR or network monitoring tools flagging command execution or unusual traffic originating from the appliance's management plane; new or modified administrative accounts, API keys, or access policies on the SMA1000 appliance.

Mitigation and workarounds

SonicWall has released patched firmware versions: 12.4.3-03526 and 12.5.0-02952 (and later). All affected SMA1000, SMA8200V, SMA7210, and SMA6210 appliances should be updated immediately. CISA's BOD 26-04 mandates federal agencies apply mitigations by September 5, 2026, and requires forensic triage of potentially compromised devices. As interim measures, restrict administrative access to the AMC to authorized personnel only, implement network segmentation to limit exposure of management interfaces, and monitor for suspicious command execution. If patching is not immediately possible, consider taking the appliance offline until it can be updated.

Apply the fixed firmware or software version published by SonicWall in advisory SNWLID-2026-0016 as soon as possible, prioritizing internet-facing SMA1000 appliances. Follow CISA's BOD 26-04 guidance for prioritizing security updates based on risk, and comply with the associated forensics triage requirements if compromise is suspected. If a patch cannot be applied immediately, restrict access to the Appliance Management Console to trusted management networks or jump hosts, enforce multi-factor authentication for all administrative accounts, and remove or disable unused administrative users. Review and rotate credentials, API keys, and certificates that could have been exposed to an attacker with OS-level access. Where mitigations are unavailable, CISA guidance allows for discontinuing use of the product; in practice, that means taking the appliance offline or replacing it with an alternative access solution until a fix is available. After remediation, validate that no unauthorized configuration changes persist and continue enhanced monitoring for a period consistent with the organization's incident response policy.

Community reactions

SonicWall issued an urgent advisory (SNWLID-2026-0016) warning of active exploitation and urging immediate patching. Rapid7 published an emergency threat response (ETR) blog post confirming in-the-wild exploitation and detailing the attack chain. Sophos, eSentire, Qualys, and multiple national CERTs (Canada, Hong Kong, UK NHS, Thailand) issued advisories. Community discussion on Reddit (r/sonicwall, r/CVEWatch) highlighted frustration with recurring SMA1000 vulnerabilities, with some users noting this was the product's third significant compromise in a short period. Dark Reading and BleepingComputer covered the story prominently, emphasizing the chained unauthenticated RCE risk. Defenders have generally framed the issue as a reminder that management planes of remote access appliances require the same urgency as internet-facing data planes.

FAQ

Q: Is CVE-2026-83549 in the CISA KEV catalog? A: Yes. CISA added it on 2026-09-02, indicating confirmed or highly likely in-the-wild exploitation.

Q: What is the CISA remediation due date? A: The due date is 2026-09-05, giving federal agencies and others a three-day window to apply mitigations and perform forensic triage per BOD 26-04.

Q: Is this vulnerability exploitable over the internet? A: The flaw is post-authentication and requires administrator access to the AMC, but the full exploit chain (with CVE-2026-83548) is remotely triggerable over the network. Internet-facing SMA1000 appliances are at elevated risk.

Q: Which products and versions are affected? A: SonicWall SMA1000 series appliances, including SMA8200V, SMA7210, and SMA6210, running firmware versions prior to 12.4.3-03526 or 12.5.0-02952. Confirm against SonicWall PSIRT advisory SNWLID-2026-0016.

Q: How can I verify if my appliance is compromised? A: Review AMC and CouchDB logs for unusual OPTIONS requests, design document creation, and sysCtrl.execCmsSnmpTrap calls. Check for unexpected processes, file modifications, and outbound connections. Follow CISA's forensics triage requirements and preserve evidence before remediation.

Q: What should I do if I cannot patch immediately? A: Restrict AMC access to trusted networks, enforce MFA, rotate credentials, and consider taking the appliance offline until it can be updated. CISA guidance allows discontinuing use of the product if mitigations are unavailable.

Related resources

• SonicWall PSIRT advisory SNWLID-2026-0016
• CISA KEV catalog entry for CVE-2026-83549
• CISA BOD 26-04 Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance and Forensics Triage Requirements
• NVD entry for CVE-2026-83549
• Rapid7 ETR blog post
• Beazley Advisory BSL-A1201
• Metasploit module for SonicWall SMA1000 CouchDB RCE
• Sophos blog on SonicWall 83548/83549
• GitHub Advisory GHSA-vxcc-7cf2-wcgh
• Public GitHub reference for CVE-2026-83548 and CVE-2026-83549