CVE-2026-83549

SonicWall SMA1000 appliances suffered an OS command injection flaw enabling remote authenticated attackers to execute arbitrary commands, resulting in remote code execution.

A remote authenticated attacker could exploit this OS command injection vulnerability to execute arbitrary OS commands, leading to full remote code execution on the appliance. This is a critical failure for DIB organizations relying on SonicWall for network security, as it directly compromises the integrity and confidentiality of protected systems. Organizations must immediately apply the available hotfixes and verify that their SMA1000 appliances are patched to prevent exploitation.

Shame score — A critical RCE vulnerability in a core network security appliance was actively exploited in the wild, indicating severe negligence in patch management and security engineering.