SonicWall's CVE records, published on 2 September 2026 (Perth time) and pointing to advisory SNWLID-2026-0016, describe two flaws in SMA1000 appliances. CVE-2026-83548 is a pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface, caused by an unintended alternate access path, that could let a remote unauthenticated attacker reach sensitive functionality and perform unauthorised operations; CISA's ADP enrichment in the record scores it CVSS 3.1 10.0, and the record credits Adam Babis of SonicWall PSIRT with finding it.

CVE-2026-83549 is a post-authentication OS command injection in the SMA1000 Appliance Management Console (AMC) that in specific conditions could let an authenticated administrator execute arbitrary OS commands, resulting in remote code execution; CISA's ADP enrichment in the record scores it CVSS 3.1 7.8 (AV:L). Both records list SMA1000 platform-hotfix 12.4.3-03453 and 12.5.0-02835 and older versions as affected. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2 September 2026 (US time). (sources: CVE records CVE-2026-83548 and CVE-2026-83549; CISA)

Correction (01 Nov 2026): removed the SecurityWeek credit, which this desk cannot read, and the details that came only from SecurityWeek or SonicWall's advisory page, which did not load for the desk (affected models, fixed hotfix builds, the chaining and zero-day claims and the list of products not affected); the card now rests on SonicWall's CVE records and CISA. (source: CVE-2026-83548 record)

Correction (1 Nov 2026): the card said SonicWall scored the two flaws; SonicWall's CVE records carry no CVSS score, and the 10.0 and 7.8 scores come from CISA's ADP enrichment in those records, so they are now credited to CISA. (source: CVE-2026-83548 and CVE-2026-83549 records (cve.org))