Cyber

What changed

On September 1, 2026, SonicWall disclosed two significant vulnerabilities affecting their SMA1000 appliances. These vulnerabilities, CVE-2026-83548 and CVE-2026-83549, are being actively exploited in the wild and can be chained to enable unauthenticated remote code execution (RCE).

CVE-2026-83548 is particularly critical, classified with a CVSS v3.1 base score of 10.0, indicating its severity. This server-side request forgery (SSRF) vulnerability allows remote attackers to exploit sensitive functionalities within the SMA1000 Appliance Work Place interface.

Who is affected

The vulnerabilities primarily impact organizations utilizing SonicWall SMA1000 appliances, which are widely used for secure remote access.

Any entity relying on these appliances for remote work solutions is at risk, especially those with exposed interfaces.

• SonicWall SMA1000 appliances deployed in enterprise environments.
• Organizations with remote work policies utilizing SonicWall products.
• IT teams responsible for maintaining network security in organizations using SonicWall solutions.

What to do

Security teams should prioritize patching affected SonicWall SMA1000 appliances as soon as updates are available. Immediate action is crucial to mitigate the risk of exploitation.

In the interim, organizations should review their network configurations and access controls to limit exposure to these vulnerabilities.

• Monitor SonicWall's official communications for patches and updates.
• Implement network segmentation to limit access to vulnerable appliances.
• Conduct a risk assessment to evaluate potential exposure and impact.

What changed

A significant vulnerability has been discovered in the database connection utilities of PaperCut NG and MF. This flaw allows for unsafe dynamic class loading, which could potentially lead to the execution of arbitrary Java bytecode.

The vulnerability arises from the application instantiating database driver classes based on user-configurable driver names without proper validation against an allowlist.

Who is affected

Organizations utilizing PaperCut NG or MF for print management are at risk due to this vulnerability. The flaw could be exploited if an attacker gains access to manipulate system configuration parameters.

This vulnerability impacts various sectors, including educational institutions, corporate environments, and government agencies that rely on PaperCut for their printing solutions.

• PaperCut NG
• PaperCut MF
• Educational institutions using PaperCut
• Corporate environments leveraging PaperCut solutions

What to do

It is crucial for affected organizations to review their configurations and ensure that only approved database drivers are utilized. Immediate updates or patches from PaperCut should be applied to mitigate this risk.

Security teams should also monitor for any unusual activity that may indicate exploitation attempts and consider implementing additional security measures to safeguard their systems.

• Review and validate database driver configurations.
• Apply patches or updates provided by PaperCut.
• Monitor system activity for signs of exploitation.
• Implement additional security measures as necessary.