Pre-auth SSRF in SonicWall SMA1000 Workplace Interface
Unauthenticated SSRF in the SMA1000 Workplace interface allows remote attackers to reach internal functionality via an unintended access path. Exploited in the wild; chains with CVE-2026-83549 for RCE.
- Vendor
- SonicWall
- Product
- SMA1000
- CVSS
- N/A
- EPSS (exploit probability)
- 8.0%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-83548 being exploited?
Yes. CISA added CVE-2026-83548 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 8.0% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-83548 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF) vulnerability in the SonicWall SMA1000 Appliance Work Place interface. An unintended alternate access path allows a remote, unauthenticated attacker to gain unauthorized access to internal functionality and perform unauthorized operations.
The vulnerability is being actively exploited in the wild, per SonicWall’s September 1, 2026 disclosure. It chains with CVE-2026-83549, a post-authentication OS command injection in the SMA1000 AMC, to enable unauthenticated remote code execution.
Affected: SonicWall SMA1000 series appliances. Consult the SonicWall PSIRT advisory for specific firmware versions and patching guidance.
Other SonicWall SMA1000 Appliances CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-102255 Critical remote vulnerability in SonicWall SMA1000write-up | [ CRITICAL ] | 10.0 | 0.5% | — |
| CVE-2026-83549 OS Command Injection in SonicWall SMA1000 AMCwrite-up | [ HIGH ] | 7.8 | 9.9% | |
| CVE-2025-40602 SonicWall SMA1000 Missing Authorization Vulnerability | [ MEDIUM ] | 6.6 | 2.8% | |
| CVE-2025-23006 SonicWall SMA1000 Appliances Deserialization Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 23.4% |
