Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

SonicWall has released security updates to address two security flaws in its Secure Mobile Access 1000 series VPN appliances that are being exploited in zero-day attacks. The vulnerabilities were discovered internally by SonicWall researchers. One of the vulnerabilities is a pre-authentication SSRF vulnerability with a CVSS score of 10.0. This vulnerability is identified as CVE-2026-83548 and affects the Appliance. The two vulnerabilities may be used together to form an attack chain. SonicWall has taken action to address the flaws with security updates.