SonicWall SMA1000 Work Place Interface server-side request forgery

Summaryinfo

A vulnerability classified as critical has been found in SonicWall SMA1000. Affected is an unknown function of the component Work Place Interface. Performing a manipulation results in server-side request forgery. This vulnerability is known as CVE-2026-83548. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in SonicWall SMA1000 (version now known). This affects some unknown processing of the component Work Place Interface. The manipulation with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.

It is possible to read the advisory at psirt.global.sonicwall.com. This vulnerability is uniquely identified as CVE-2026-83548 since 08/31/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but an exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/03/2026).

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 09/02/2026 with a due date of 09/05/2026:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3135). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• SonicWall SMA

Productinfo

Type

• Firewall Software

Vendor

• SonicWall

Name

• SMA1000

License

• commercial

Website

• Vendor: https://www.sonicwall.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion