SonicWall SMA 1000 Devices Targeted in Active Exploitation Campaigns

Threat actors are actively exploiting a critical server-side request forgery (SSRF) vulnerability in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. The flaw, tracked as CVE-2026-83548, allows remote unauthenticated attackers to gain system access, which has been leveraged to deploy reverse shells and cryptocurrency mining payloads.

In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, signaling widespread abuse. SonicWall has also issued patches after identifying the issue internally, confirming that the flaw was being exploited in real-world attacks prior to mitigation availability.

Vulnerability Details

• CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF) vulnerability affecting SonicWall SMA 1000 appliances.
• It carries a maximum CVSS score of 10.0, indicating critical severity.
• The flaw enables remote unauthenticated attackers to send crafted requests and potentially execute arbitrary code.
• Successful exploitation can lead to full system compromise including data theft, lateral movement, and persistent backdoors.

Observed Threat Activity

• Attackers have deployed reverse shells and crypto miners following successful exploitation.
• CISA reports that threat actors are chaining CVE-2026-83548 into broader intrusion campaigns.
• No authentication required makes this an attractive target for automated scanning tools.
• Indicators suggest ongoing scanning and exploitation attempts across exposed devices globally.

Sources

• CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
• Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain