CVE-2026-83548

Summary

CVE	CVE-2026-83548
State	PUBLISHED
Assigner	sonicwall
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-09-01 22:17:13 UTC
Updated	2026-09-03 13:06:16 UTC
Description	A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.

Risk And Classification

Primary CVSS: v3.1 10 CRITICAL from ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.087570000 probability, percentile 0.949960000 (date 2026-09-29)

CISA KEV: Listed on 2026-09-02; due 2026-09-05; ransomware use Unknown

Problem Types: CWE-441 | CWE-918 | CWE-918 CWE-918 Server-Side request forgery (SSRF) | CWE-441 CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')

Version	Source	Type	Score	Severity	Vector
3.1	ADP	DECLARED	10	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	10	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA Known Exploited Vulnerability

Vendor	SonicWall
Product	SMA1000 Appliances
Name	SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
Required Action	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes	https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Sonicwall	Sma8200v	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	SonicWall	SMA1000	affected 12.4.3-03453 (platform-hotfix) and older versions	Linux
CNA	SonicWall	SMA1000	affected 12.5.0-02835 (platform-hotfix) and older versions	Linux

References

Reference	Source	Link	Tags
psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016	[email protected]	psirt.global.sonicwall.com	Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog	134c704f-9b21-4f2e-91b3-4a467353bcc0	www.cisa.gov	US Government Resource
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis
CISA Known Exploited Vulnerabilities catalog	CISA	www.cisa.gov	kev

Vendor Comments And Credit

Discovery Credit

CNA: Adam Babis of SonicWall PSIRT (en)

Additional Advisory Data

Source	Time	Event
ADP	2026-09-02T00:00:00.000Z	CVE-2026-83548 added to CISA KEV

There are currently no legacy QID mappings associated with this CVE.