OS Command Injection in SonicWall SMA1000 AMC
Post-auth OS command injection in the SonicWall SMA1000 AMC allows an authenticated administrator to execute arbitrary OS commands. CVSS 7.8 HIGH. Chains with CVE-2026-83548 for unauthenticated RCE.
- Vendor
- SonicWall
- Product
- SMA1000 Appliance Management Console
- CVSS
- 7.8
- EPSS (exploit probability)
- 9.9%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-83549 being exploited?
Yes. CISA added CVE-2026-83549 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 9.9% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-83549 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-83549 is an OS command injection flaw in the SonicWall SMA1000 Appliance Management Console (AMC). Classified as an Improper Neutralization of Special Elements used in an OS Command vulnerability. Under specific conditions, an authenticated attacker with administrator-level access can execute arbitrary OS commands remotely.
CVSS 7.8 (HIGH), per NVD. Published September 1, 2026.
In isolation, exploitation requires administrator credentials. Chained with CVE-2026-83548, a pre-authentication SSRF in the SMA1000 Workplace interface, unauthenticated attackers can bypass that requirement and reach remote code execution.
Both vulnerabilities are confirmed under active exploitation as of the September 1, 2026 SonicWall disclosure. Consult the SonicWall PSIRT advisory for affected firmware versions and patches.
Other SonicWall SMA1000 Appliances CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-102255 Critical remote vulnerability in SonicWall SMA1000write-up | [ CRITICAL ] | 10.0 | 0.5% | — |
| CVE-2026-83548 Pre-auth SSRF in SonicWall SMA1000 Workplace Interfacewrite-up | [ HIGH ] | — | 8.0% | |
| CVE-2025-40602 SonicWall SMA1000 Missing Authorization Vulnerability | [ MEDIUM ] | 6.6 | 2.8% | |
| CVE-2025-23006 SonicWall SMA1000 Appliances Deserialization Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 23.4% |
