July's patch is September's vulnerable build

On 14 July, SonicWall closed a pair of exploited zero-days on its SMA 1000 appliances with build 12.4.3-03453. On 1 September it published another advisory. Among the affected versions: 12.4.3-03453 and earlier. The build that made you current in July is the newest vulnerable build in September, and 49 days passed in between.

We already wrote about July's: the perimeter VPN appliance is the perfect target. Coming back to the same box seven weeks later is not something we enjoy, and that is exactly why this post is not about patching faster. It is about something you only see when you put both advisories side by side.

Both advisories, in one table

This comes from the NVD records and the vendor advisories, not from headlines:

The row that matters is the sixth. 12.4.3-03453 is both the build that fixed July and the newest build September lists as affected. That is not a wording detail: whoever met the three-day KEV deadline in July —which was the right call— landed on exactly the build that is back in that same catalog 49 days later.

And the CVSS vector of both SSRFs is identical, character for character. Same score, same vector, same flaw class (CWE-918), same component. Twice in seven weeks.

The "local" that does not protect you

Here is the part that deprioritises itself. July's execution CVE came with AV:N (network) and PR:H (high privileges). September's comes with AV:L —local attack vector— and PR:L. An IT manager who opens the record, reads "local", and has the AMC restricted to the management network closes the tab feeling fine. It is the logical reaction and it is the wrong one. And one detail is worth putting on the table before going further: the description SonicWall itself signs off on for that CVE speaks of "a remote authenticated attacker as administrator" —remote, and admin— while the vector says AV:L and PR:L. July's, described in almost the same words, was scored AV:N and PR:H. The bug did not change that much between July and September; what changed is how it was scored. And that leaves you no way out: either the AV:L is literal and something has to hand you that "local", or it is not and then it is reachable over the network.

Because "local" is exactly what the other CVE in the pair hands over. SonicWall describes the 10.0 with a phrase of its own worth reading slowly: "Pre-authentication SSRF via unintended forward-proxy". An unintended forward proxy. And the classification on that record did not stop at the usual CWE-918: SonicWall itself, as the CNA, also assigned CWE-441 —and CISA mirrors it in its KEV entry—, whose official MITRE name is "Unintended Proxy or Intermediary (Confused Deputy)" — the product receives a request and does not sufficiently preserve its origin before forwarding it outside its own control sphere.

That this is not our speculation is backed by July, which was documented step by step. Rapid7, who found that pair, described the SSRF as letting an attacker "open a websocket-based tunnel to arbitrary localhost-only services", reach the internal ctrl-service on port 8188, and from there execute commands as root. They called July's second CVE literally "a local privilege escalation". In July, "local" was already reachable; in September it is what the score itself says.

What we are not claiming

The question moves

A flaw is a flaw. The same shape of flaw twice in 49 days —an unauthenticated door that forwards requests, plus a management console that executes— is no longer bad luck: it is the appliance's architecture telling you something. And from there the useful question stops being "is it patched?" and becomes "how far does that box reach when someone else is driving it?".

The practical difference between the two questions is that the vendor answers the first one every time it publishes an advisory, while you answered the second one once, years ago, the day you set the concentrator up — and have not looked at it since.

In the SMEs that come to us, that concentrator usually does two jobs that are not the same job. One: letting remote staff reach the applications. Two: letting branch offices and the odd supplier reach the datacenter. They ended up on the same box because nobody wanted a second appliance, and at the time that was a reasonable call. The problem is that the second job does not need a public portal, yet it inherits all the exposure of the first.

Separating site-to-site transport from user remote access is the part of this that is design, not patching. It is what we do when we build multi-site SD-WAN: connectivity between branches takes its own path, with per-site policy, and does not hang on whether the remote-work portal survives this week's advisory. Compromising the portal no longer means automatically inheriting the routes to every site.

If you run an SMA 1000, in this order

A note on the calendar, which is the part nobody mentions: both advisories entered the KEV with a three-day deadline. Three days to inventory, coordinate a window, update the box every remote worker comes through, and review indicators on top. Twice in seven weeks. That is not absorbed by one person who also has a day job; it is absorbed by an on-call rota with a procedure, which is exactly what 24×7 support exists for. And today, 7 September, the second advisory's deadline expired two days ago.

In short

We are not SonicWall resellers, or anyone's, and this post is not about switching brands: the next box will have its own advisories. It is about the fact that an appliance repeating the same shape of flaw within 49 days is handing you a design data point, not a maintenance task. The vendor ships the patch when it can. The reach —what that box gets to touch on the day it is not yours— is set by you, and it is the only part of all this that does not depend on the next build.

Sources (verified 7 Sep 2026): SonicWall advisory SNWLID-2026-0016 (1 Sep 2026), affected and fixed versions, "Pre-authentication SSRF via unintended forward-proxy" and remediation steps — sonicwall.com; CVSS vectors and CWEs for CVE-2026-83548, CVE-2026-83549, CVE-2026-15409 and CVE-2026-15410 — NVD (records in Analyzed status); KEV dates and deadlines from CISA's catalog (version 2026.09.04); July's fixed builds and the websocket tunnel, ctrl-service and port 8188 mechanics — Rapid7; exploitation start date for July's pair (22 Jun 2026, actor UTA0533) — Volexity, via Cybersecurity Dive; CWE-441 definition — MITRE.