CVE-2026-83548

What is the SonicWall SMA1000?

The SonicWall Secure Mobile Access (SMA) 1000 series (models 6210, 7210, and the virtual 8200v) is an enterprise remote-access/SSL-VPN appliance that terminates connections from remote employees at the network edge. Edge VPN gateways are among the most targeted devices on the internet — they are reachable by design, hold credentials and session tokens, and sit directly in front of internal networks. The SMA1000 line itself has prior KEV history (CVE-2025-23006 was exploited as a zero-day in January 2025).

Overview

CVE-2026-83548 is a pre-authentication server-side request forgery (CVSS 10.0) in the SMA1000 WorkPlace user portal, exploited in the wild as a zero-day before SonicWall's 2026-09-01 advisory. Its real significance is as the entry half of a chain: the SSRF gives an unauthenticated attacker a path to the internal Appliance Management Console (AMC), where the companion command-injection flaw CVE-2026-83549 executes OS commands — together, unauthenticated remote code execution on the appliance. CISA added both to KEV on 2026-09-02 with a 2026-09-05 deadline.

Affected Versions

SMA 100 series appliances and SonicWall firewalls are not affected.

Technical Details

The SSRF sits in the unauthenticated WorkPlace portal: a remote attacker can cause the appliance to issue internal requests on their behalf, reaching sensitive functionality that should only be accessible from the management plane — most critically, the AMC. No authentication, no user interaction, low complexity. On its own the SSRF yields unauthorized access to internal functionality; chained with the AMC command injection (CVE-2026-83549) it becomes full appliance compromise, which is why this half carries the CVSS 10.0 and changed scope.

Discovery

Credited to SonicWall's own William Perry and Adam Babis; SonicWall detected the ongoing exploitation itself — both CVEs were zero-days at disclosure.

Exploitation Context

SonicWall confirmed active in-the-wild exploitation at disclosure on 2026-09-01; no threat actor has been named and the start date of the attacks was not disclosed. ~420 SMA1000 appliances are internet-reachable per Shadowserver. Given the device class — the same niche where Ivanti, Citrix, and Fortinet edge devices have fed ransomware and espionage operations — compromised appliances should be treated as full network-perimeter breaches. SonicWall advises credential and token resets on any confirmed compromise and IoC review with its support team.

Remediation

1. Apply the platform hotfix now: 12.4.3-03526 or 12.5.0-02952 depending on branch. Federal deadline: 2026-09-05.
2. Hunt before you trust: review AMC and WorkPlace logs for unexpected internal requests, configuration changes, and new admin sessions; engage SonicWall support for current IoCs.
3. On any suspicion of compromise, reset all credentials and tokens terminated on the appliance — local admin accounts, LDAP/AD service accounts, user VPN sessions, and certificates.
4. Restrict AMC management access to a dedicated management network — it should never be reachable via the user-facing interface path.
5. Patch the companion flaw CVE-2026-83549 (same hotfix) and keep the SMA1000 firmware current — this platform is a repeat zero-day target.