{
 "Event": {
  "uuid": "77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
  "info": "SonicWall SMA 1000 Zero-Day Chain Exploited for Remote Code Execution",
  "date": "2026-09-02",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"other\""
   },
   {
    "name": "misp-galaxy:country=\"united states\""
   },
   {
    "name": "misp-galaxy:country=\"australia\""
   },
   {
    "name": "misp-galaxy:country=\"germany\""
   },
   {
    "name": "misp-galaxy:country=\"japan\""
   },
   {
    "name": "misp-galaxy:country=\"singapore\""
   },
   {
    "name": "misp-galaxy:sector=\"Government\""
   },
   {
    "name": "misp-galaxy:sector=\"Technology\""
   },
   {
    "name": "misp-galaxy:sector=\"Financial Services\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/sonicwall-sma-1000-zero-day-chain-exploited-for-remote-code-execution/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "SonicWall disclosed that threat actors are chaining two previously unknown vulnerabilities in SMA 1000 remote-access appliances. CVE-2026-83548, a CVSS 10.0 pre-authentication server-side request forgery in the WorkPlace interface, is used to reach internal functionality, and CVE-2026-83549, a CVSS 7.8 OS command injection in the Appliance Management Console, converts that access into arbitrary command execution. CISA added both to the Known Exploited Vulnerabilities catalogue on 2 September 2026 with a remediation deadline of 5 September. Compromise of these appliances yields authenticated network position behind perimeter controls.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}