SonicWall SMA1000 Appliance Vulnerabilities Added to CISA KEV

What's on the official record

2 September — CVE-2026-83548, server-side request forgery. CISA added CVE-2026-83548, a server-side request forgery vulnerability in SonicWall SMA1000 Appliances (CWE-918, CWE-441), to the Known Exploited Vulnerabilities Catalog on 2 September 2026. The remediation due date for federal civilian agencies is 5 September 2026. Catalog version 2026.10.21. The record names no fixed version and points to a vendor advisory. FIRST's EPSS model estimates a 0.080 probability of exploitation (95th percentile, 2026-10-23). CISA's ADP records exploitation active, automatable yes, impact total. The catalog does not record known ransomware use.

2 September — CVE-2026-83549, OS command injection. CISA added CVE-2026-83549, an OS command injection vulnerability in SonicWall SMA1000 Appliances (CWE-78), to the Known Exploited Vulnerabilities Catalog on 2 September 2026. The remediation due date for federal civilian agencies is 5 September 2026. Catalog version 2026.10.21. The record names no fixed version and points to a vendor advisory. FIRST's EPSS model estimates a 0.099 probability of exploitation (96th percentile, 2026-10-23). CISA's ADP records exploitation active, automatable no, impact total. The catalog does not record known ransomware use.

Assessment

For a platform or AI-stack owner, the record lets you check whether SonicWall SMA1000 appliances are in your estate and whether the vendor's advisory mitigations have been applied. Both vulnerabilities carry CISA ADP impact total, and the catalog names no fixed version. That supports a decision to patch, isolate, or pull affected appliances until the vendor's guidance is applied.

For a cyber underwriter, the record lets you ask policyholders whether SonicWall SMA1000 appliances are in scope and whether the vendor's mitigations have been applied. Both vulnerabilities carry CISA ADP impact total, and the catalog does not record known ransomware use. Use that to decide whether to require a control or adjust pricing on affected estates.

What would change this call

The record names no fixed version for either CVE. A vendor advisory naming a fixed release, or an updated CISA catalog entry, would change the patch and underwriting checks.

What to check next

Confidence

Filed 25 October 2026 from the record dated 2 September 2026. The record is CISA's Known Exploited Vulnerabilities Catalog entry for the two CVEs.

Sources

[1] SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-83548

[2] CVE record CVE-2026-83548 — https://www.cve.org/CVERecord?id=CVE-2026-83548

[3] SonicWall SMA1000 Appliances OS Command Injection Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-83549

[4] CVE record CVE-2026-83549 — https://www.cve.org/CVERecord?id=CVE-2026-83549

[5] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog