Our automated tracking framework flagged that CISA added CVE-2026-83549 (SonicWall SMA1000 Appliances) to the Known Exploited Vulnerabilities (KEV) catalog on September 5, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-83549 by September 5, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-83549 |
| Vendor / product | SonicWall SMA1000 Appliances |
| Vulnerability | SonicWall SMA1000 Appliances OS Command Injection Vulnerability |
| CVSS base score | 7.8 |
| Added to KEV | September 2, 2026 |
| Days public before listing (NVD → KEV lag) | 1 |
| Federal patch deadline | September 5, 2026 |
| Known ransomware use | No |
How This Compares to SonicWall’s Track Record
This one was public for just 1 days before CISA confirmed exploitation — faster than SonicWall’s 197-day median, meaning attackers moved unusually quickly. SonicWall currently ranks #24 on our KEV Lag leaderboard.
| SonicWall in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 19 |
| Median lag (public → KEV listing) | 197 days |
| 0-day rate (exploited at or before disclosure) | 16% |
| Entries tied to known ransomware campaigns | 10 |
For perspective, the median across all 1695 tracked KEV entries is 260 days — SonicWall’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent SonicWall KEV Additions
The most recent SonicWall vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-83548 | SMA1000 Appliances | September 2, 2026 | 1 | No |
| CVE-2026-15409 | SMA1000 Appliances | July 14, 2026 | 0 | No |
| CVE-2026-15410 | SMA1000 Appliances | July 14, 2026 | 0 | No |
| CVE-2025-40602 | SMA1000 appliance | December 17, 2025 | -1 | No |
| CVE-2023-44221 | SMA100 Appliances | May 1, 2025 | 513 | No |
What This Means for Defenders
CISA has added CVE-2026-83549, affecting SonicWall SMA1000 Appliances, to its Known Exploited Vulnerabilities (KEV) catalog. This OS Command Injection Vulnerability carries a CVSS base score of 7.8, signaling high severity. Federal agencies must patch by September 5, 2026, a tight deadline given its September 2 KEV listing. Organizations using SonicWall SMA1000 Appliances should make this an urgent priority for immediate remediation.
The one-day lag between this vulnerability’s public disclosure and its KEV listing for CVE-2026-83549 suggests attackers quickly weaponized the flaw. Though no known ransomware use has been identified, OS command injection vulnerabilities can lead to full system compromise. The compressed window for detection and response means it’s critical to act now.
Security teams managing SonicWall SMA1000 Appliances must patch immediately. If patching before the September 5 federal deadline isn’t feasible, implement compensating controls. These should include network segmentation to isolate affected devices, stringent access controls, and continuous monitoring for anomalous activity. Strengthen perimeter defenses and conduct proactive threat hunting for signs of exploitation.
Related Coverage
- SonicWall’s CVE-2026-83548 Was Exploited in 1 Days — Well Under Its 197-Day Median (September 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
