Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
NVD: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Hunt SMA1000 Work Place interface logs for SSRF attempts with internal target URLs (127.0.0.1, 169.254.169.254, RFC 1918 IPs). Monitor outbound connections from SMA1000 to internal networks.
Research details
ComponentSMA1000 Appliance Work Place interface (pre-auth SSRF via unintended forward-proxy)
PreconditionsNetwork reachability to SMA1000 Appliance Work Place interface; no authentication required; the Work Place interface must be exposed; no version-specific precondition beyond default configuration; actively exploited in the wild, often chained with CVE-2026-83549 for full RCE agent
Exploit notesActively exploited zero-day confirmed by SonicWall PSIRT. The SSRF in the Work Place interface is due to an unintended alternate access path (forward-proxy). Exploitation of CVE-2026-83548 is often chained with CVE-2026-83549 (post-auth command injection) for full RCE. MFA seeds were reportedly stolen in July 2026. CVSS attack complexity: LOW | CRITICAL severity (CVSS 10.0)
SummaryCVE-2026-83548 is a pre-authentication SSRF vulnerability in the SonicWall SMA1000 Appliance Work Place interface, scoring CVSS 10.0. An unintended alternate access path allows unauthenticated remote attackers to forge server-side requests, gaining access to sensitive internal functionality. Actively exploited in the wild as a zero-day, often chained with CVE-2026-83549 (post-auth command injection) for complete device compromise. This is the third major SMA1000 exploitation chain in seven weeks.
Tia coverage
First reported2026-07-15
First exploit report2026-09-02
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.