SonicWall SMA1000 Work Place Pre-Auth SSRF (CVE-2026-83548)

SonicWall's advisory SNWLID-2026-0016 describes CVE-2026-83548 as a pre-authentication server-side request forgery (SSRF) in the SMA1000 Work Place interface. It names the cause as "an unintended alternate access path" and adds that a remote unauthenticated attacker "could potentially" reach sensitive functionality. The advisory heading for this flaw calls it an unintended forward proxy.

SonicWall rates it CVSS 3.0 10.0 Critical, with a network vector, low complexity, and no privileges or user interaction needed. SonicWall PSIRT says it investigated a case that points to active exploitation of the flaws in this advisory.

What an Unintended Forward Proxy Means

In an SSRF, the attacker makes a server send requests for them. Here the request goes through the appliance, which sits at the edge of the network and can reach internal systems the attacker cannot.

Rapid7's write-up, published on 2 September 2026, says SonicWall confirmed active exploitation. Rapid7 also advises checking whether appliances were already compromised before patching is treated as done.

SonicWall's advisory and the CVE record give the same short description of the flaw.

The Companion Flaw CVE-2026-83549

The same advisory covers CVE-2026-83549, an OS command injection in the Appliance Management Console (AMC). It needs an administrator login and SonicWall rates it CVSS 3.0 7.8 High. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2 September 2026.

This page covers CVE-2026-83548 only. The AMC flaw is described here only as far as SonicWall's advisory and the CISA entry go.

The Fix Came Before the Advisory

SonicWall's technical note for platform hotfix 12.5.0-02952 gives a release date of 28 August 2026. It lists SMA1000-9429, a pre-authentication SSRF via an unintended forward proxy, and SMA1000-9424, a post-authentication remote code execution. These match the titles of the two CVEs in the advisory, which came out on 1 September.

The vulnerable builds of this CVE include 12.4.3-03453 and 12.5.0-02835. Those are the builds that SonicWall's July advisory named as the fix for the earlier SMA1000 flaw, CVE-2026-15409. An appliance that took the July fix was therefore still exposed to this one.

What Our Checks Showed About the Public Record

We checked the catalogues and public sources on 4 November 2026. SonicWall's own statement of exploitation is in the advisory, and the table adds what the catalogues and public sources show.

The four repositories differ. One README presents a non-intrusive exposure checker and says it only sends read requests. Another calls itself a learning project, and a third holds a title and a donation banner.

The newest, created on 25 October, describes a tool for assessing and exploiting the flaw. We did not run it.

Several Blackhole posts come from automated CVE alert feeds. Read the count as attention to the CVE, not as a measure of attacks. For context, our known exploited vulnerabilities glossary entry explains what a CISA KEV listing means.

SonicWall lists the SMA1000 models 6210, 7210 and 8200v. Both the physical and the virtual appliances need the hotfix, and SonicWall names no workaround. The advisory says the flaws do not affect SSL-VPN on SonicWall firewalls or the SMA 100 Series.

NVD lists the same fixed builds as the end of the vulnerable range for the 8200v, 6210 and 7210. The CVE record names Linux as the platform. SonicWall says the latest platform hotfix is available on mysonicwall.com.

SonicWall also tells every owner of an affected appliance to ask Technical Support to review the system for indicators of compromise. If any are found, SonicWall says to re-image a hardware appliance or re-deploy a virtual one. The vendor adds that all user and administrator passwords must change and TOTP tokens must be reset.

The log indicators in SonicWall's July advisory SNWLID-2026-0008 cover the earlier flaw, CVE-2026-15409. The September advisory does not repeat them. We would still read them as a starting point for a hunt, and our indicator of compromise entry explains how to use them.

Patch planning for edge appliances is covered in our vulnerability management guide. It helps when the same product needs a second hotfix within weeks.