Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances that have been exploited in zero-day attacks. The vulnerabilities, discovered internally by SonicWall's William Perry and Adam Babis, are listed below - CVE-2026-83548 (CVSS score: 10.0) - A pre-authentication SSRF vulnerability in the Appliance

Fact: SonicWall released patches for two zero-day vulnerabilities in its SMA 1000 series VPN appliances, including a CVSS 10.0 pre-auth SSRF flaw, after observing active exploitation in the wild. Fact: These issues affect remote access infrastructure that many organizations rely on as part of their broader digital and security stack. Analysis: For organizations that integrate VPN appliances into AI infrastructure (e.g., securing access to model-serving endpoints or agent backends), compromise of these devices can undermine the integrity and confidentiality of AI systems by giving attackers a foothold into internal networks. Practical implication: RealGround would focus on mapping such third-party network appliances into the AI supply chain, ensuring they are included in SBOM-style inventories, patch management workflows, and threat modeling for AI environments so that zero-day exploitation in upstream infrastructure does not cascade into AI system compromise.