[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1nMWvtFwZMWSLqdymVbf5AFgmZ8ZsyaiThhhRSzGgIQ":3},{"article":4,"iocs":51,"watch_terms":58,"solutions":59,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"7ef71a0b-3a78-4c57-9ae0-1757701b9add","Attackers exploit zero-days in consistently besieged SonicWall product","attackers-exploit-zero-days-in-consistently-besieged-sonicwall-product-e522bd","SonicWall customers have confronted a barrage of attacks for years, including five actively exploited vulnerabilities in SMA 1000 appliances since late 2025. The post Attackers exploit zero-days in consistently besieged SonicWall product appeared first on CyberScoop.","SonicWall has disclosed two actively exploited zero-day vulnerabilities (CVE-2026-83548 and CVE-2026-83549) in its SMA 1000 appliances. These vulnerabilities, a server-side request forgery and an OS command injection flaw, can be chained for unauthenticated remote-code execution. This marks another significant security incident for SonicWall, which has a history of its products being targeted by various threat actors, including ransomware groups and state-sponsored entities.","SonicWall SMA 1000 appliances targeted by two actively exploited zero-day vulnerabilities.","https:\u002F\u002Fcyberscoop.com\u002Fsonicwall-sma1000-zero-days-actively-exploited\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2025\u002F05\u002FGettyImages-1312190811.jpg","2026-09-03T22:12:53+00:00","2026-09-04T00:00:09.542297+00:00",9,[17,20,23,26],{"name":18,"type":19},"SMA 1000 appliances","product",{"name":21,"type":22},"SonicWall","vendor",{"name":24,"type":25},"server-side request forgery","technology",{"name":27,"type":25},"OS command injection","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44,49],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":50},{"id":28,"icon":30,"name":31,"slug":32},[52,56],{"type":53,"value":54,"context":55},"cve","CVE-2026-83548","Zero-day vulnerability in SonicWall SMA 1000 appliances.",{"type":53,"value":57,"context":55},"CVE-2026-83549",[21,18],{"controls":60,"vendors":148},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-private-access","Zscaler Private Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-private-access","Zero trust access to private applications, replacing VPN.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-access","Cloudflare Access","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Faccess\u002F","Zero trust access to internal applications without a VPN.",{"slug":91,"name":92,"problem":93,"products":94},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":120,"name":121,"problem":122,"products":123},"patch-management","Automated patch management","Known holes get closed in days, not months.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[149,152],{"slug":96,"name":97,"logo_path":98,"roles":150},[151],"reported_by",{"slug":153,"name":21,"logo_path":154,"roles":155},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[156],"affected",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":172},"zero-day-chain-in-sonicwall-sma-1000-enables-unauthenticated-rce","Zero-Day Chain in SonicWall SMA 1000 Enables Unauthenticated RCE","Two actively exploited zero-day vulnerabilities in SonicWall's SMA 1000 appliances — a server-side request forgery (SSRF) and an OS command injection flaw — can be chained together to achieve unauthenticated remote code execution, requiring no credentials from an attacker. This is especially dangerous because SMA 1000 devices are internet-facing network gateways, meaning successful exploitation grants attackers a direct foothold into enterprise networks. SonicWall has a documented history of being a high-value target for ransomware groups and nation-state actors, making its appliances a recurring weak link in perimeter defenses. The incident underscores the critical risk of relying on edge devices that lack compensating controls when patches are unavailable or delayed.",[162,163,164,165,166,167,168,169,170,171],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST RA-5: Vulnerability Monitoring and Scanning","NIST IR-4: Incident Handling","ITIL: Change Management \u002F Emergency Change Procedures","CISA KEV (Known Exploited Vulnerabilities) Catalog — remediation timelines",{}]