SonicWall: 2 Actively-Exploited Flaws Added to CISA KEV
Key findings • Two SonicWall vulnerabilities (CVE-2026-83548, CVE-2026-83549) added to CISA KEV on September 2, 2026. • These flaws are confirmed to be under active exploitation in the wild, …
Key findings
- Two SonicWall vulnerabilities (CVE-2026-83548, CVE-2026-83549) added to CISA KEV on September 2, 2026.
- These flaws are confirmed to be under active exploitation in the wild, posing immediate threats.
- Organizations using affected SonicWall products must apply patches and mitigations without delay.
- No ransomware association has been reported for these specific vulnerabilities.
- CISA's KEV catalog mandates remediation for federal agencies and strongly advises it for all others.
The Cybersecurity and Infrastructure Security Agency (CISA) has included two SonicWall vulnerabilities, CVE-2026-83548 and CVE-2026-83549, in its Known Exploited Vulnerabilities (KEV) catalog as of September 2, 2026. This addition signifies that these flaws are under active exploitation in the wild, posing an immediate and significant threat to organizations utilizing affected SonicWall products. The KEV catalog serves as a critical resource, mandating federal civilian executive branch agencies to remediate listed vulnerabilities within specified deadlines, and strongly advising all other organizations to do the same.
The newly cataloged vulnerabilities include:
- **CVE-2026-83548**: A critical flaw affecting SonicWall products that has been confirmed to be actively exploited.
- **CVE-2026-83549**: Another actively exploited vulnerability within the SonicWall ecosystem, also requiring urgent attention.
Neither of these vulnerabilities has been publicly associated with ransomware campaigns at the time of their addition to the KEV catalog. However, their active exploitation status alone underscores the severe risk they present, as attackers are already leveraging these weaknesses to compromise systems.
Defenders must prioritize the immediate patching and mitigation of these vulnerabilities across all affected SonicWall deployments. CISA typically sets a remediation deadline of six months for federal agencies once a vulnerability is added to the KEV catalog, but for actively exploited flaws, prompt action is paramount for all organizations. Regularly consulting the KEV catalog and implementing a robust vulnerability management program are essential practices to defend against the most pressing cyber threats.