CVE-2026-83549: SonicWall SMA1000 Post-Auth OS Command Injection (KEV)
CVE-2026-83549 is a post-authentication OS command injection in the Appliance Management Console (AMC) of SonicWall's SMA1000 remote-access appliances that lets an already-authenticated administrator execute arbitrary OS commands, and CISA added it to the KEV catalog the same day as the related pre-auth SSRF CVE-2026-83548 from the same SonicWall bulletin, with a forensic-triage requirement rather than patching alone.
Vulnerability summary
| Vulnerability ID | CVE-2026-83549 |
|---|---|
| CVSS score | 7.8 |
| EPSS score | 0.09889 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD (CISA-ADP Secondary score only, not NVD Primary) |
| Published | 2026-09-01T22:17:13.290 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| SonicWall SMA1000 Appliances (SMA8200v, SMA6210, SMA7210) | cpe:2.3:a:sonicwall:sma8200v:*:*:*:*:*:*:*:* | SMA8200v, SMA6210 firmware and SMA7210 firmware: before 12.4.3-03526 (fixed in 12.4.3-03526); 12.5.0 and later before 12.5.0-02952 (fixed in 12.5.0-02952) |
What this means
CVE-2026-83549 is an Improper Neutralization of Special Elements used in an OS Command (CWE-78) vulnerability in SonicWall SMA1000 appliances. NVD's Analyzed record describes it as a "Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability" in "the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution" (NVD).
NVD has not published its own independent Primary CVSS score for this record; the only metric on file is a CISA-ADP Secondary rating of CVSS v3.1 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — local attack vector, low privileges required, no user interaction, high impact to confidentiality, integrity and availability. So the 7.8 shown here is the CISA-ADP Secondary score, not an NVD-confirmed Primary score (NVD).
SonicWall's own PSIRT advisory page for this CVE (SNWLID-2026-0016) — the same bulletin ID cited for the related CVE-2026-83548 — renders as a client-side JavaScript application with no advisory text in the initial HTML response, so it could not be read as a static source in this session; the affected-product list and fixed-version numbers below come from NVD's structured configuration data instead, which names SMA8200v (software) and the SMA6210/SMA7210 firmware as vulnerable before build 12.4.3-03526, and in the 12.5.0 branch before build 12.5.0-02952 — identical to the affected range published for CVE-2026-83548 (NVD).
CISA added CVE-2026-83549 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02, with a required-action due date of 2026-09-05 — a three-day window — and marks this CVE as requiring CISA's forensic-triage guidance under BOD 26-04, the same treatment given to CVE-2026-83548 from the same bulletin. Known ransomware campaign use is recorded as "Unknown." Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).
As of 2026-10-28, FIRST scores the probability of exploitation at 0.09889 (95.557th percentile) (FIRST EPSS).
Because the vendor's own advisory text was not readable in this session, any organization running SMA1000 appliances should treat the NVD/KEV-sourced guidance above as a starting point, confirm current firmware against SonicWall's MySonicWall portal directly, and upgrade to the fixed builds immediately given the short KEV remediation window, CISA's forensic-triage flag, and the fact this is one of two actively exploited CVEs from the same bulletin.
Evidence
- Post-authentication OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC), letting a remote authenticated administrator execute arbitrary OS commands resulting in RCE. — NVD
- CVSS v3.1 base score is 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — a CISA-ADP Secondary rating; NVD has not published its own Primary score. — NVD
- Affected: SMA8200v software and SMA6210/SMA7210 firmware before build 12.4.3-03526, and 12.5.0 branch before build 12.5.0-02952 (fixed at those builds); SonicWall's own PSIRT advisory page (SNWLID-2026-0016, shared with CVE-2026-83548) is a client-rendered JavaScript app with no readable advisory text in this session. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-02, required-action due date 2026-09-05, flagged for CISA's forensic-triage requirement under BOD 26-04, ransomware use Unknown. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
- EPSS score is 0.09889 (95.557th percentile) as of 2026-10-28. — FIRST EPSS