CVE-2026-83549

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Sep 21, 2026

Description

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
SonicWall	SMA1000	12.4.3-03453 (platform-hotfix) and older versions; 12.5.0-02835 (platform-hotfix) and older versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549US Government Resource

Timeline

Published: Sep 1, 2026
Last modified: Sep 21, 2026
Added to CISA KEV: Sep 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-83555.4IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with CVE-2026-835507.1A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metri CVE-2026-835517.2Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11 CVE-2026-835555.3The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a su CVE-2026-835575.6DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly CVE-2026-83565.4LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement re CVE-2026-835605.3The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the CVE-2026-835617.2The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elem CVE-2026-835626.5Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.CVE-2026-835647.0Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-835655.5Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.CVE-2026-835667.0Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.