CVE-2026-83549

HIGH7.8Published on September 1, 2026

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

CVSS score7.8 / 10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-78

SonicWall SMA1000 sotto attacco: due zero-day consentono SSRF e comandi sul sistema

Vulnerabilities

SonicWall SMA1000 Under Attack: Two Zero-Days Enable SSRF and System Command Execution

Two SonicWall SMA1000 zero-days (CVE-2026-83548, CVE-2026-83549) are actively exploited enabling SSRF and OS command execution. Learn affected models, hotfixes and CISA KEV guidance.

Sep 2, 20265 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

SonicWall SMA1000 Under Attack: Two Zero-Days Enable SSRF and System Command Execution