{"id":"CVE-2026-83548","kind":"vulnerability","aliases":["CVE-2026-83548"],"related":[],"title":"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended…","description":"SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"SonicWall SMA1000 appliances contain a server-side request forgery flaw that a remote unauthenticated attacker can use to reach sensitive functionality and run unauthorized operations. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-09-02T00:00:00+00:00","products":[{"name":"SonicWall SMA1000 Appliances","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":["12.4.3-03526"],"affected":"< 12.4.3-03526","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":["12.5.0-02952"],"affected":">= 12.5.0, < 12.5.0-02952","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":["12.4.3-03526"],"affected":"< 12.4.3-03526","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":["12.5.0-02952"],"affected":">= 12.5.0, < 12.5.0-02952","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":["12.4.3-03526"],"affected":"< 12.4.3-03526","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":["12.5.0-02952"],"affected":">= 12.5.0, < 12.5.0-02952","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","poc-public","self-hosted","sma1000","sonicwall","vendor","vpn-gateway"],"not_affected_if":["no-sma1000-deployed"],"how_to_check":"Identify SMA1000 appliances in your estate and confirm their firmware versions against the SonicWall advisory for CVE-2026-83548.\nReview appliance logs for unexpected internal request patterns and unfamiliar administrative actions, per CISA's forensics triage guidance referenced in the KEV entry.","fix":"Apply the SonicWall vendor mitigation or firmware update for CVE-2026-83548 as directed by CISA BOD 26-04; if no mitigation is available, discontinue use of the affected appliance per CISA guidance.","status":"open","published_at":"2026-09-01T22:17:13+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:43+00:00","updated_at":"2026-10-25T09:38:59+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:31:43Z","model":"claude-haiku-5-5","output":{"fix":"Apply the SonicWall vendor mitigation or firmware update for CVE-2026-83548 as directed by CISA BOD 26-04; if no mitigation is available, discontinue use of the affected appliance per CISA guidance.\nunknown","summary":"SonicWall SMA1000 appliances contain a server-side request forgery flaw that a remote unauthenticated attacker can use to reach sensitive functionality and run unauthorized operations. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["sonicwall","sma1000","vpn-gateway","self-hosted"],"confidence":0.7,"analyst_note":"Fixed-version and advisory URL are not in the sources; pull the SonicWall PSIRT advisory and the CISA KEV/BOD 26-04 page to fill fix and how_to_check.","how_to_check":"Identify SMA1000 appliances in your estate and confirm their firmware versions against the SonicWall advisory for CVE-2026-83548.\nReview appliance logs for unexpected internal request patterns and unfamiliar administrative actions, per CISA's forensics triage guidance referenced in the KEV entry.\nunknown","needs_analyst":true,"not_affected_if":["no-sma1000-deployed"],"severity_if_unknown":"high"},"cost_usd":0.000452,"input_tokens":2237,"output_tokens":456,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':138C,164C,195C '-2026':20A,23A '-83548':21A,24A '26':137C,163C,194C 'access':113C 'accord':127C 'action':123C 'activ':87B 'adher':191C 'allow':105C 'appli':124C 'applianc':11A,59B,94C 'appliances':27A 'applic':161C 'asset':185C 'attack':72B,109C 'authent':4A 'base':142C 'bod':136C,162C,193C 'cisa':83B,121C,134C,151C 'cloud':167C 'complianc':132C 'contain':60B,95C 'could':104C 'cve':19A,22A 'discontinu':170C 'due':15A 'ensur':131C,190C 'evalu':183C 'exist':7A 'exploit':44B,88B 'exposur':188C 'firmware':34A,37A,40A,43A 'flaw':67B 'follow':160C 'forens':153C 'forgeri':66B,101C 'function':78B,116C 'gain':111C 'gateway':56B 'guidanc':149C,165C 'guidelin':197C 'host':50B 'instruct':130C 'interfac':14A 'internet':187C 'list':84B 'mitig':125C,176C 'note':148C,159C 'oper':82B,120C 'patch':196C 'perform':118C 'place':13A 'poc':46B 'poc-publ':45B 'pre':3A 'pre-authent':2A 'priorit':139C 'product':174C 'public':47B 'reach':76B 'remot':70B,107C 'request':65B,100C 'requir':122C,155C 'respons':181C 'risk':144C 'run':80B 'secur':140C 'see':145C,156C 'self':49B 'self-host':48B 'sensit':77B,115C 'server':63B,98C 'server-sid':62B,97C 'servic':168C 'side':64B,99C 'sma1000':10A,26A,51B,58B,93C 'sma6210':33A,36A 'sma7210':39A,42A 'sma8200v':29A,31A 'sonicwal':52B,57B,92C 'sonicwall':25A,28A,30A,32A,35A,38A,41A 'ssrf':5A 'stakehold':179C 'triag':154C 'unauthent':71B,108C 'unauthor':81B,112C,119C 'unavail':178C 'unintend':18A 'updat':141C 'url':146C,157C 'use':74B,171C 'vendor':53B,129C 'vpn':55B 'vpn-gateway':54B 'vulner':6A,102C 'wild':91B 'work':12A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-01T22:17:13+00:00","kev":{"dateAdded":"2026-09-02","dueDate":"2026-09-05","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-83548","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83548","severity":null,"published_at":"2026-09-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-83548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83548","severity":null,"published_at":"2026-09-01T22:17:13+00:00","modified_at":"2026-09-03T13:06:16+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"github-poc","external_id":"maxprog-svg/CVE-2026-83548","url":"https://github.com/maxprog-svg/CVE-2026-83548","severity":null,"published_at":"2026-10-25T09:20:33+00:00","modified_at":null,"first_seen_at":"2026-10-25T09:25:03+00:00","fetched_at":"2026-10-25T09:25:03+00:00","note":null}],"documents":[{"id":3456,"url":"https://github.com/maxprog-svg/CVE-2026-83548","title":"maxprog-svg/CVE-2026-83548","kind":"poc","source":"github","text":"CVE-2026-83548 — SonicWall SMA1000 Work Place pre-auth SSRF\n\nstars 0","published_at":"2026-10-25T09:20:33+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}