CVE-2026-83548
Description
CVE-2026-83548 is a critical CVSS 10 SSRF in SonicWall SMA1000 appliances. Actively exploited, it allows unauthenticated remote access. Patch immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| sma8200v | * | 12.4.3-03526 | vulnerable |
| sma8200v | 12.5.0 | 12.5.0-02952 | vulnerable |
| sma8200v | - | - | unaffected |
| sma6210_firmware | * | 12.4.3-03526 | vulnerable |
| sma6210_firmware | 12.5.0 | 12.5.0-02952 | vulnerable |
| sma6210 | - | - | unaffected |
| sma7210_firmware | * | 12.4.3-03526 | vulnerable |
| sma7210_firmware | 12.5.0 | 12.5.0-02952 | vulnerable |
| sma7210 | - | - | unaffected |
Related weakness (CWE)
Remediation plan
Apply official patches
Download and install the latest firmware updates from the SonicWall support portal specifically addressing the SNWLID-2026-0016 advisory.
Update affected systems
Ensure SMA 6210, 7210, and 8200v appliances are upgraded to at least version 12.4.3-03526 or 12.5.0-02952 to remediate the SSRF flaw.
Restrict access
Limit access to the SMA Work Place interface to trusted IP addresses and implement strict egress filtering to prevent the appliance from initiating unauthorized outbound requests.
Monitor for exploitation
Conduct a forensic triage of appliance logs for unusual HTTP requests to internal management interfaces or unexpected outbound network connections originating from the SMA device.
Detection Guidance
"Detection should focus on identifying anomalous HTTP requests targeting the SMA1000 Work Place interface. Monitor web server logs for requests containing internal IP addresses or loopback references in URL parameters, which are indicative of SSRF. Additionally, analyze network traffic for unexpected outbound connections from the SMA appliance to internal sensitive services or external malicious IPs. Organizations should also check for unauthorized access logs that coincide with the exploitation of the unintended alternate access path."