Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-83548

Published 2026-09-01

Updated 2 months ago

Vendor/s

SonicWall

Product/s

SMA1000 Appliances

Version/s

\* > 12.4.3-03526

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

10

/ 10

Critical

Severity Details

Base score

10 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-83548 is a critical CVSS 10 SSRF in SonicWall SMA1000 appliances. Actively exploited, it allows unauthenticated remote access. Patch immediately.

## Why this matters

"CVE-2026-83548 is a critical pre-authentication SSRF vulnerability in SonicWall SMA1000 series appliances, carrying a maximum CVSS score of 10.0. Because it allows remote, unauthenticated attackers to bypass security controls via the Work Place interface, it poses a severe risk to organizational perimeters. This vulnerability is currently listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Security teams must prioritize this update immediately, as successful exploitation can lead to unauthorized access to internal resources, sensitive data exfiltration, and full system compromise without any user interaction or valid credentials."

## CPE

SonicWall

| Product           | Version Start | Version End (excl.) | Status     |
| ----------------- | ------------- | ------------------- | ---------- |
| sma8200v          | \*            | 12.4.3-03526        | vulnerable |
| sma8200v          | 12.5.0        | 12.5.0-02952        | vulnerable |
| sma8200v          | -             | -                   | unaffected |
| sma6210\_firmware | \*            | 12.4.3-03526        | vulnerable |
| sma6210\_firmware | 12.5.0        | 12.5.0-02952        | vulnerable |
| sma6210           | -             | -                   | unaffected |
| sma7210\_firmware | \*            | 12.4.3-03526        | vulnerable |
| sma7210\_firmware | 12.5.0        | 12.5.0-02952        | vulnerable |
| sma7210           | -             | -                   | unaffected |

## Related weakness (CWE)

CWE-441, CWE-918

## Remediation plan

1

### Apply official patches

Download and install the latest firmware updates from the SonicWall support portal specifically addressing the SNWLID-2026-0016 advisory.

2

### Update affected systems

Ensure SMA 6210, 7210, and 8200v appliances are upgraded to at least version 12.4.3-03526 or 12.5.0-02952 to remediate the SSRF flaw.

3

### Restrict access

Limit access to the SMA Work Place interface to trusted IP addresses and implement strict egress filtering to prevent the appliance from initiating unauthorized outbound requests.

4

### Monitor for exploitation

Conduct a forensic triage of appliance logs for unusual HTTP requests to internal management interfaces or unexpected outbound network connections originating from the SMA device.

## Detection Guidance

"Detection should focus on identifying anomalous HTTP requests targeting the SMA1000 Work Place interface. Monitor web server logs for requests containing internal IP addresses or loopback references in URL parameters, which are indicative of SSRF. Additionally, analyze network traffic for unexpected outbound connections from the SMA appliance to internal sensitive services or external malicious IPs. Organizations should also check for unauthorized access logs that coincide with the exploitation of the unintended alternate access path."

## References

[https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 Vendor Advisory ](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-83548 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)