On September 1, 2026, SonicWall disclosed two flaws in the SMA 1000 line — a pre-authentication SSRF (CVE-2026-83548, CVSS 10) and an OS command injection (CVE-2026-83549) — already chained in the wild to reach remote code execution without credentials. Apply the hotfix now, and if compromise is confirmed, re-image the appliance instead of patching over the intrusion.

On August 19, 2026, CISA added CVE-2026-64849, an unauthenticated SSRF in MLflow, to its Known Exploited Vulnerabilities catalog. Any exposed MLflow tracking server should move to 3.15.0 and drop unused webhooks before the September 2, 2026 deadline.