CVE-2026-83548: SonicWall SMA1000 pre-auth SSRF via alternate access path

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityPre-authentication, network-reachable SSRF with CVSS 10.0 and confirmed KEV listing with a near-term remediation deadline.

What it is

The SMA1000 Appliance Work Place interface exposes an unintended alternate access path that allows server-side request forgery before authentication. A remote unauthenticated attacker can use it to reach sensitive internal functionality and perform unauthorized operations. Because it is pre-auth, network-reachable and rated critical, it is a high-value target for edge-appliance compromise.

Impact

An attacker gains unauthorized access to sensitive functionality and can perform unauthorized operations through the appliance, potentially reaching internal services via forged requests. The scope change in the CVSS vector indicates impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network through the Work Place interface with no authentication and no user interaction required (AV:N/PR:N/UI:N). The unintended alternate access path is the entry point; no credentials or victim action are needed.

Exploitation

CISA added it to KEV on 2026-09-02 with a remediation due date of 2026-09-05, indicating known exploitation. EPSS 30-day probability is 0.04667 (91st percentile); no ransomware campaign use is documented.

What to do

• Apply the SonicWall vendor fix per advisory SNWLID-2026-0016 immediately; treat the 2026-09-05 KEV due date as the deadline.
• If a patch is not yet available, follow CISA BOD 26-04 guidance: apply vendor mitigations or discontinue use of the exposed product.
• Remove or restrict internet exposure of the SMA1000 Work Place interface until patched.
• Restrict outbound traffic from the appliance to only required destinations to blunt SSRF reach into internal networks.
• Verify no unauthorized configuration or account changes were made before patching.

Detection

• Review appliance and perimeter logs for requests to the Work Place interface from unauthenticated or unexpected sources, especially to unusual paths.
• Monitor outbound connections originating from the SMA1000 to internal or unfamiliar external hosts for SSRF patterns.
• Alert on configuration changes, new accounts or administrative actions on the appliance outside change windows.
• Hunt for known exploitation indicators from vendor and CISA guidance for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.