CVE-2026-83548

Exploited in the wild. In CISA KEV since 2026‑09‑02. A vendor fix is available.

CVSS 3.110.0Critical EPSS percentile95th8.8% chance in 30 days CISA KEVListedsince 2026-09-02, due 2026-09-05
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-01Updated 2026-09-03Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your SonicWall SMA1000 has the Work Place interface enabled.
Check whether the SMA1000 is reachable from the internet on the Work Place-related network paths (external IPs/port forwarding/firewall rules/load balancers).
If Work Place is enabled and the device is internet-reachable, treat this as actively exploited and apply SonicWall’s mitigations immediately; if no mitigation is available for your version, discontinue use until you can mitigate.
Confirm your environment is updated to the fixed guidance provided by SonicWall for SMA1000; if no fixed version is available, implement the vendor’s stated compensating controls (and block/restrict external access to Work Place paths).

May need vendor or contractor work

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.

In plain language

Written by AI from the record

CVE-2026-83548 is a serious security hole in SonicWall SMA1000’s “Work Place” interface that lets an attacker send the device to access other systems without logging in—so if your SMA1000 has Work Place enabled and is reachable, you should act immediately.

Unauthenticated SSRF in the SonicWall SMA1000 Appliance Work Place interface allows pre-auth network-triggered requests to arbitrary or restricted internal/unauthorized targets via an unintended alternate access path.

If you're affected

Unauthorized access to management functions
Exposure of internal network resources
Service disruption risk
Potential device compromise leading to takeover

What is it

This flaw lets someone who isn’t logged in trick your SonicWall SMA1000 into making “requests” from inside your network. Think of it like handing a stranger a master key to tell your device to go fetch things from places it shouldn’t reach.
If exploited, that can expose internal systems or enable follow-on misuse of the device’s sensitive capabilities.

Who is affected

This matters if you run a SonicWall SMA1000 and you have the “Work Place” interface enabled. It’s particularly urgent if your SMA1000 can be reached from the internet along the Work Place-related access paths.
Because the issue is pre-authentication, the attacker does not need a login—only network reachability to the relevant interface/feature path.

How urgent is it

This is RED because CISA has confirmed it in KEV as exploited in the real world. Attackers are using it in active attacks and chaining it with another zero-day to escalate from network access to deeper device impact.
You should treat internet-reachable SMA1000 deployments with Work Place enabled as under direct threat.

What to do — in detail

Identify exposure scope (fast):
- Confirm the SonicWall SMA1000 is present in your environment.
- Determine whether the Work Place interface is enabled on that device.
- Review how clients reach it: public IPs, port forwarding, firewall/NAT rules, and any load balancers/WAF rules that allow inbound connections to Work Place.
Determine whether you are likely reachable:
- If Work Place is enabled AND inbound network access to the Work Place interface exists from the internet, assume exposure.
- If Work Place is disabled or the interface is not reachable externally, risk is lower, but confirm your configuration matches what’s actually deployed (including any alternate access paths).
Act immediately using CISA + vendor guidance:
- Follow SonicWall’s vendor instructions for CVE-2026-83548 mitigations.
- If SonicWall instructs to discontinue use when mitigations aren’t available, follow that guidance.
- CISA KEV due date for required mitigation actions: 2026-09-05.
Compensating controls if a patch/fixed version is not available:
- Restrict or block inbound access to Work Place-related endpoints from the internet (tight firewall rules / remove port forwards / adjust gateway routing).
- Apply any vendor-recommended configuration changes that remove the unintended alternate access path.
- Limit exposure to only necessary trusted networks if the product must remain online.
Validation after changes:
- Re-check that the Work Place interface is still enabled only if necessary, and that external reachability to it is blocked as instructed.
- Ensure your changes persist across restarts/automation and that no other external access path still exists.
Monitoring to prioritize incident readiness:
- Increase monitoring for suspicious inbound requests targeting Work Place-related functions.
- Watch for unusual server-side request behavior consistent with SSRF-style activity (unexpected outbound/internal connections initiated by the device).
- If you have EDR/log aggregation, create an alert for Work Place endpoints receiving unauthenticated traffic.

Note: The provided findings say no specific fixed version/patch details are available yet. Your immediate priority is vendor mitigations and network restriction per KEV guidance.

Technical context

Severity is critical (pre-auth SSRF with high impact conditions). This is a pre-authentication weakness (no login required) in the SonicWall SMA1000 Appliance Work Place interface caused by an unintended alternate access path. Mechanism: a remote attacker can trigger the appliance to send server-side requests to arbitrary targets or restricted internal resources, potentially enabling access to sensitive functionality and unauthorized operations.

Exploitation status: CISA KEV confirms real-world exploitation (listed 2026-09-02) and requires mitigations by 2026-09-05. Press reporting additionally indicates attackers are chaining CVE-2026-83548 with CVE-2026-83549 for remote code execution in zero-day attacks.

Exploit maturity: No public exploit code is on record (per findings), but active exploitation is confirmed by KEV/news.

EPSS: a prediction exists (0.3% and flat trend), but KEV/news confirmation overrides reliance on prediction for urgency.

Patch status: no fix/patch information is available in the provided findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

CISA KEV

Listed as exploited in the wild since 2026-09-02.

US federal agencies must remediate by 2026-09-05.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

8.8% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising, driven by in-the-wild reports.

Lifecycle

15 events over 8 days, from the signal feeds we watch.

2026-09-09Nuclei check added
2026-09-08Analysis publishedSonicWall's SMA1000 Just Had Its Third Zero-Day SSRF Pair in Nine Months
2026-09-04OpenVAS check added
2026-09-03Patch availablerecord updated
2026-09-02Added to CISA KEVpatch available, record updated, record updated, record updated, record updated
2026-09-01Publishedweakness classified, att&ck mapped, record updated

Affected products

SonicWallcommercial · US

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable