SonicWall's Remediation Guidance Says the Patch Is Only Step One of Four

This story was originally published on HackerNoon at: https://hackernoon.com/sonicwalls-remediation-guidance-says-the-patch-is-only-step-one-of-four.
SonicWall confirmed two SMA 1000 zero-days under active exploitation. Its own remediation guidance ends with resetting TOTP tokens. Here's why that matters.
Check more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity. You can also check exclusive content about #network-security, #vpn-security, #vulnerability-management, #edge-device-security, #totp-seed-exposure, #sonicwall-sma-1000, #cve-2026-83548, #cve-2026-83549, and more.

This story was written by: @nickmarsteller. Learn more about this writer by checking @nickmarsteller's about page, and for more stories, please visit hackernoon.com.

SonicWall disclosed two SMA 1000 flaws on September 1, both exploited in the wild: CVE-2026-83548, a pre-auth SSRF scoring CVSS 10.0, and CVE-2026-83549, an OS command injection. Chained, they reach unauthenticated RCE. The overlooked part is SonicWall's own guidance for a confirmed compromise — re-image, change all passwords, and reset TOTP tokens. A VPN gateway is an authentication store. A patch closes the code path; it cannot un-copy the seeds an intruder already took.