SonicWall's VPN Gateway Just Got Hit With Its Third Zero-Day Attack Chain This Year, and 22,000 Exchange Servers Are Still Sitting Open a Month After the Patch

Start with the number that should stop any SonicWall SMA1000 administrator mid-scroll: three. That's how many distinct zero-day attack chains have hit this single product line in under twelve months, and today's disclosure is the latest one. SonicWall confirmed active exploitation of two new vulnerabilities — CVE-2026-83548 and CVE-2026-83549 — discovered internally by the company's own security team, affecting the SMA1000 6210, 7210, and 8200v secure remote access gateways. CISA added both to its Known Exploited Vulnerabilities catalog today with a remediation deadline of September 5 for federal civilian agencies — a three-day window that tells you exactly how urgently the agency is treating this.

The mechanism behind the worse of the two flaws is worth understanding precisely, because it's a genuinely elegant piece of attacker tradecraft rather than a simple missing-auth-check bug. CVE-2026-83548, rated a maximum 10.0, lives in the SMA1000's WorkPlace interface, specifically in a component called /wsproxy that was built to proxy WebSocket traffic for legitimate SMA Connect clients. According to root-cause analysis from the threat intelligence firm Resecurity, that endpoint accepts attacker-supplied destination host and port parameters without authentication, backend whitelist enforcement, or origin validation — and by spoofing the client identifiers the endpoint uses to decide what's legitimate, an unauthenticated attacker can turn the appliance itself into a forward proxy working on their behalf. The practical effect is a classic confused-deputy attack: a crafted request causes the SMA1000 to route traffic internally on the attacker's instructions, reaching backend services that were designed to be reachable only from the appliance's own localhost — no login, no session token, no user interaction required at any point. The second flaw, CVE-2026-83549, rated 7.8, is an OS command injection vulnerability in the Appliance Management Console that requires administrator-level authentication to trigger on its own — but multiple outlets covering this disclosure note the two vulnerabilities can be chained together, meaning the unauthenticated SSRF flaw can be the thing that gets an attacker into a position to then reach the second, more privileged flaw.

The pattern this fits into is the part that should genuinely concern anyone running this product line long-term, not just this week. In July, two separate SMA1000 zero-days — CVE-2026-15409 and CVE-2026-15410 — were actively exploited for weeks before patching, used to install custom malware on vulnerable appliances, and CISA later confirmed ransomware gangs had begun abusing them in real-world attacks. Before that, in December, SonicWall warned customers about yet another SMA1000 zero-day being chained to gain root privileges, and the company separately linked state-backed hackers to a security breach that exposed customers' own firewall configuration backup files. Three distinct zero-day incidents on the same product line inside of a year is not a coincidence worth writing off as bad luck — SMA1000 gateways are exactly the kind of internet-facing, credential-adjacent infrastructure that's worth an attacker's sustained research investment, and this week's disclosure is the latest return on that investment, not the last one. SonicWall's own guidance beyond patching is worth following literally: if indicators of compromise turn up on any affected appliance, don't just apply the hotfix — reimage the device, reset every administrator password, and regenerate TOTP tokens, since a compromised gateway that's merely patched in place may still be carrying forward whatever access the attacker already established.

The second story of the day is a quieter kind of alarming — not a fresh zero-day, but a month-old, fully-patched vulnerability that a meaningful share of the internet still hasn't gotten around to fixing. Shadowserver's daily internet-wide scanning identified 21,899 unique IP addresses running Microsoft Exchange Server still vulnerable to CVE-2026-62911, a critical authentication-bypass-by-capture-replay flaw that Microsoft patched during its August 2026 Patch Tuesday — a full month before this count was taken. The vulnerability, discovered by Orange Tsai of DEVCORE Research Team working with Trend Micro's Zero Day Initiative, lets an attacker who can capture and replay authentication traffic impersonate legitimate users and escalate privileges across the server, ultimately reaching every mailbox it hosts. The United States leads the exposure count with roughly 6,200 vulnerable servers, followed by Germany at approximately 5,100 — both countries' own national cybersecurity authorities, CISA and Germany's BSI, along with the Netherlands' NCSC-NL, have all issued their own warnings, with NCSC-NL specifically flagging that working exploit code is already circulating publicly.

There's a real operational trap buried in this specific patch that's worth naming directly, because it likely explains part of why the number is still this high a month later. Security teams who applied a general cumulative update to their Exchange servers may reasonably assume they're covered — but sub-versions released before the specific August 2026 security update remain exploitable even on an otherwise "patched" server, meaning "we ran Windows Update recently" and "we're actually protected against this specific CVE" are not the same claim. If you run on-premises Exchange anywhere in your environment, the right move today is checking your exact build number against Microsoft's published guidance directly, not assuming a recent-looking patch history covers this one. Organizations still running Exchange Server 2016 or 2019 face an additional wrinkle: those versions only receive security updates through Microsoft's Extended Security Updates program now, and NCSC-NL's specific advice for anyone in that position is blunt — restrict the server to internal access only, and replace it if you realistically can.

Two stories, one shared lesson sitting underneath both, even though they're not really about the same failure. SonicWall's SMA1000 disclosure is about how much research investment a single, valuable piece of infrastructure can attract once it's identified as worth attacking — three attack chains in a year isn't randomness, it's attention. The Exchange story is about how much distance can open up between "a fix exists" and "the fix is actually applied," even for a vulnerability serious enough to draw warnings from three separate national cybersecurity authorities. Neither gap closes itself. Patching on a monthly cycle was already too slow for the first kind of target before this month started, and a full month of exposure after a patch ships is proving to be plenty of runway for the second kind of gap to matter in the real world.