CVE-2026-83549

● KEV HIGH

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) wh...

Affects 0 products across 1 vendor.

CVSS 3.17.8
EPSS10.8%
Percentile96th
PatchUnknown
KEV Added2026-09-02
CVSS Vector — Plain English Requires local access, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-78
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-78
CAPEC-88 OS Command Injection
via CWE-78

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A high severity vulnerability (CVE-2026-83549) affects the target system. Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a...

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-83549?
A high severity vulnerability (CVE-2026-83549) affects the target system. Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a...
What is the CVSS score for CVE-2026-83549?
CVE-2026-83549 has CVSS 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 10.8%.
Is CVE-2026-83549 actively exploited?
Yes. CVE-2026-83549 is in the CISA KEV catalog (added 2026-09-02). Active exploitation confirmed. Immediate patching required.
How do I remediate CVE-2026-83549?
Apply vendor patches for CVE-2026-83549. Monitor Sonicwall advisories.
What systems are affected by CVE-2026-83549?
CVE-2026-83549 affects: Sonicwall.
Vulnerability Details
CVE IDCVE-2026-83549
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2026-09-01
Last Modified2026-09-21
ICS Relevance90%
Weakness (CWE)
OS Command Injection
SourceNVD
Official Description

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Source: NIST NVD / MITRE CVE Database

Affected Products
VendorProductFixed Version
Sonicwall — —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: September 2026 | Threat Age: 26 Days
CISA KEV● Active Exploitation Confirmed (added 2026-09-02)
Public ExploitNot confirmed
PoC CodeNot confirmed
Related CVEs affecting Sonicwall
CVE-2026-83548 10.0 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work ... CVE-2007-5815 10.0 Absolute path traversal vulnerability in the WebCacheCleaner ActiveX control ... CVE-2021-44228 10.0 Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2... CVE-2026-15409 10.0 A Server-side request forgery (SSRF) vulnerability has been identified in the... CVE-2016-2396 9.9 The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, an...
View all Sonicwall CVEs →

This Vulnerability Is Being Actively Exploited

CVE-2026-83549 is on the CISA KEV list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.

Create a free account →