CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection

Exploited in the wild High 7.8 Published 1 Sep 2026 Updated 21 Sep 2026

Authenticated administrators can execute arbitrary OS commands on SonicWall SMA1000 appliances via the management console.

Exploited in the wild: Since 2 Sep 2026
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-83549?

CVE-2026-83549 is a high-severity command injection vulnerability in SonicWall SMA1000, published on 1 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Weakness: CWE-78

Which versions are affected by CVE-2026-83549?

It affects 3 products.

Products include Sonicwall Sma6210 Firmware, Sonicwall Sma7210 Firmware, Sonicwall Sma8200v.

How do I fix CVE-2026-83549?

No fix has been published for CVE-2026-83549 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 5 Sep 2026.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-83549 being exploited?

Yes. Attackers have exploited CVE-2026-83549 in the wild since at least 2 Sep 2026.

Public exploit code: 1 Metasploit module.

Sources

Also known as GHSA-vxcc-7cf2-wcgh.