SonicWall has released patches for two zero-day vulnerabilities (CVE-2026-83548 and CVE-2026-83549) in its Secure Mobile Access (SMA) 1000 series VPN appliances that are being actively exploited. These flaws, including a pre-authentication SSRF, can be chained to achieve unauthenticated remote code execution. Organizations using these appliances must apply the updates immediately to prevent compromise.