Status: KEV | Advisory ID: CVE-2026-83549
| CVE | CVE-2026-83549 |
| CVSS | CVSS 7.8 (High). |
| Affected products | SonicWall SMA1000 Appliances, SonicWall SMA8200V, SonicWall SMA6210 Firmware, and SonicWall SMA7210 Firmware |
| Exploitation status | Listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation. |
| Classified as | CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')) |
| KEV listing | Added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02. |
| Exploitation prediction (EPSS) | 9% probability of exploitation in the next 30 days (95% percentile) -- FIRST.org's EPSS model. |
| Federal remediation deadline | 2026-09-05 (CISA KEV, Binding Operational Directive). |
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-83549 |
| Vendor advisory | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 |