CVE-2026-83548: SonicWall SMA1000 Pre-Auth SSRF Added to CISA KEV — Patch Immediately

TL;DR

CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF) flaw in the SonicWall SMA1000 Work Place interface, reachable without credentials by any remote attacker who can touch the appliance. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02 with a remediation due date of 2026-09-05, and the CVSS 3.1 base score is 10.0 (Critical). If you operate an internet-facing SMA1000 series appliance, treat it as actively targeted today: apply the vendor fix from SonicWall PSIRT advisory SNWLID-2026-0016, restrict exposure, and run forensic triage before returning any suspect device to production.

What is this vulnerability?

Field	Detail
CVE	CVE-2026-83548
Vendor / Product	SonicWall / SMA1000 Appliances (Work Place interface)
Vulnerability class	Server-Side Request Forgery (SSRF) via unintended alternate access path
Weaknesses	CWE-918 (SSRF), CWE-441 (Unintended Proxy or Intermediary)
CISA KEV added	2026-09-02
CISA remediation due	2026-09-05
Known ransomware use	Unknown
CVSS 3.1 base	10.0 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS	~0.047 score, ~91st percentile
Vendor advisory	SonicWall PSIRT SNWLID-2026-0016

Overview

CVE-2026-83548 is a server-side request forgery vulnerability in the SonicWall SMA1000 appliance family, specifically in the Work Place interface that publishes internal applications to remote users. SonicWall's own summary describes it as a pre-authentication SSRF caused by an unintended alternate access path: a remote, unauthenticated attacker can reach sensitive functionality and perform unauthorized operations that should sit behind authentication and access control. The vendor published advisory SNWLID-2026-0016, and CISA added the CVE to the KEV catalog on 2026-09-02 with a due date of 2026-09-05 — a three-day window that signals expected or already-observed exploitation.

The affected product line is the SMA1000 series, which includes the SMA6210, SMA7210, and SMA8200V appliances. Public reporting from Wiz's vulnerability database and Rapid7's Emergency Threat Response (ETR) coverage points to firmware versions 12.4.3-03453 and earlier, plus 12.5.0-02835 and earlier, as the vulnerable range. Because the SMA1000 is typically deployed as a remote-access gateway at the network edge, it sits directly on the trust boundary between the public internet and internal corporate resources — exactly the position an SSRF primitive wants.

Severity signals line up across sources. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network reachable, low complexity, no privileges, no user interaction, scope changed, and high impact to confidentiality, integrity, and availability. Wiz rates the CVE as Critical with a base score of 10. Defenders should care for three reasons: the flaw is pre-auth, the target is an edge appliance that often holds credentials and MFA seeds, and CISA's KEV listing removes any ambiguity about whether exploitation is theoretical.

Technical details

The root cause is an unintended alternate access path in the SMA1000 Work Place listener (referenced in public analysis as mod_extraweb) that allows absolute-form HTTP OPTIONS requests to be proxied to internal loopback services without authentication. Public research describes the chain reaching CouchDB on 127.0.0.1:5984 using default credentials, and — when chained with CVE-2026-83549 — achieving root-level remote code execution. The two CWEs map cleanly: CWE-918 for the SSRF itself, and CWE-441 for the appliance acting as an unintended proxy or intermediary.

Attack prerequisites are minimal:

• Network reachability to the Work Place interface is sufficient; no session, token, or credential is required.
• No user interaction — the request is machine-to-machine.
• Affected versions (per public reporting):
  • SMA1000 series (SMA6210, SMA7210, SMA8200V) running 12.4.3-03453 and earlier
  • SMA1000 series running 12.5.0-02835 and earlier
• Exposure surface: the Work Place interface, typically published on HTTPS/443.
• Parser discrepancy: public analysis describes crafted URIs using backslash characters and ../ traversal sequences that exploit differences between ExtraWeb and libcurl path handling, bypassing path classification checks and CORS normalization.

Because the request is forwarded before authentication, the SSRF primitive can be used to reach services bound to loopback that were never intended to be internet-reachable. The exact fixed-version matrix should always be confirmed against SNWLID-2026-0016, since vendor advisories are authoritative on build numbers.

Impact

Successful exploitation of CVE-2026-83548 alone gives an unauthenticated remote attacker access to sensitive internal functionality on the appliance. Public analysis goes further: when chained with CVE-2026-83549, the attack achieves arbitrary command execution as root (uid 0), producing complete compromise of confidentiality, integrity, and availability on the device.

The realistic abuse scenarios are the ones that keep incident responders up at night:

• Management-plane compromise. The SMA1000 is a control point for remote access. Root on the appliance means root on the gateway that brokers trust for the rest of the enterprise.
• Credential and MFA seed theft. Edge appliances frequently hold or broker authentication material. Post-exploitation activity described in public reporting includes credential and MFA seed theft.
• Persistent backdoors. Root-level access enables durable persistence that survives reboots and ordinary remediation.
• Lateral movement. The appliance is designed to sit between the internet and internal networks; an attacker who owns it can pivot inward using the trust relationships it already has.
• Data exfiltration. With command execution and internal reachability, exfiltration paths are plentiful.

The CVSS scope-changed rating (S:C) is the key structural point: impact is not confined to the vulnerable component. Business exposure scales with how much of your remote-access strategy depends on SMA1000 appliances and how much of your internal network they can reach.

Exploitability

CVE-2026-83548 is on the CISA KEV catalog, added 2026-09-02 with a due date of 2026-09-05. KEV listing is the strongest public signal that a vulnerability is being exploited in the wild, and the three-day federal remediation window is unusually tight.

EPSS sits around 0.047 with a percentile near 91%. That combination — a modest absolute score but a high percentile — is consistent with a targeted, high-value edge appliance rather than mass opportunistic scanning. Attackers who want a specific network will prioritize a pre-auth SSRF on a remote-access gateway; attackers running broad commodity campaigns may not.

Public exploit and proof-of-concept references exist. Two GitHub repositories are publicly associated with the CVE: an analysis repository (xoessie/CVE-2026-83548-SonicWall-SMA1000-Analysis) and a repository referencing both CVE-2026-83548 and CVE-2026-83549 (HORKimhab/CVE-2026-83548-CVE-2026-83549). Rapid7 has published a Metasploit module for the chained CouchDB-to-RCE path, and its ETR report confirms in-the-wild exploitation. The practical takeaway: do not wait for a polished public exploit before patching — the tooling already exists.

KEV vs CVSS vs EPSS

Signal	What it measures	Action for this CVE
CISA KEV	Confirmed in-the-wild exploitation; carries a binding remediation deadline for federal agencies	Treat as emergency. Due 2026-09-05. Patch or mitigate now; complete forensic triage per BOD 26-04 guidance.
CVSS 3.1 (10.0)	Theoretical severity of the flaw itself — network reachable, no auth, no interaction, scope changed, high C/I/A impact	Use to justify emergency change windows and executive escalation.
EPSS (~0.047 / ~91st percentile)	Probability of exploitation activity in the next 30 days, relative to all CVEs	High percentile supports prioritization, but KEV already settles the question. Do not let a modest absolute score delay action.

Exploitation steps (defensive triage)

These steps are written for hunters, patch owners, and SOC analysts validating exposure and compromise — not as an attack recipe.

1. Inventory and fingerprint. Enumerate every SonicWall SMA1000 appliance (SMA6210, SMA7210, SMA8200V) in your estate. Confirm firmware builds against the vulnerable ranges reported publicly (12.4.3-03453 and earlier; 12.5.0-02835 and earlier) and against SNWLID-2026-0016.
2. Assess exposure. Determine which Work Place interfaces are internet-facing. Any appliance reachable from the public internet should be treated as the highest-priority asset in your patch queue.
3. Hunt the request pattern. Search Work Place/ExtraWeb access logs for absolute-form HTTP OPTIONS requests containing backslash characters, randomized path segments, or ../ traversal sequences. These are the signature of the SSRF trigger described in public analysis.
4. Hunt the internal pivot. Look for HTTP traffic originating from the Work Place process to 127.0.0.1:5984 (CouchDB) or 127.0.0.1:8188 (ctrl-service) with unusual request patterns, and for XML-RPC calls invoking sysCtrl.execCmsSnmpTrap with anomalous parameters.
5. Check for post-exploitation artifacts. Review CouchDB logs for unexpected design documents (especially erlang language or rewrites with randomized operation names), and check /opt/couchdb/etc/local.d/local-settings.ini for injected [native_query_servers] or enable_erlang_query_server = true entries.
6. Inspect process behavior. Look for unexpected child processes spawned by the CouchDB service account (/bin/bash, curl, wget), sed processes with -e flags containing base64 strings, and root processes spawned from ctrl-service or cmsSnmpTrap.sh.
7. Patch and verify. Apply the fixed firmware, then re-scan to confirm the build is no longer in the vulnerable range and that the Work Place interface is no longer reachable from untrusted networks.
8. Rotate and re-baseline. Rotate credentials, API tokens, and MFA seeds that were reachable from the appliance. If compromise is suspected, complete CISA's Forensics Triage Requirements before returning the device to service.

Indicators of compromise

• Network: Unusual HTTP OPTIONS requests to the SMA1000 Work Place interface (HTTPS/443) with absolute-form URIs containing backslashes, random path segments, and ../ traversal sequences.
• Network: Unexpected outbound connections from the SMA1000 appliance to attacker-controlled IPs, consistent with a reverse shell.
• Network: Internal HTTP traffic from the Work Place process to 127.0.0.1:5984 (CouchDB) or 127.0.0.1:8188 (ctrl-service) with unusual request patterns.
• File system: Modifications to /opt/couchdb/etc/local.d/local-settings.ini containing injected [native_query_servers] or enable_erlang_query_server = true entries; unexpected files or scripts on the appliance; new cron jobs or startup entries created by the couchdb or root service accounts.
• Logs: Work Place/ExtraWeb access logs showing OPTIONS requests with absolute URIs and unusual path structures; CouchDB logs showing unexpected design documents; CouchDB log writer redirected to the INI file path; XML-RPC calls to ctrl-service invoking sysCtrl.execCmsSnmpTrap with anomalous parameters.
• Process: Unexpected child processes spawned by the CouchDB service account; sed processes with -e flags containing base64-encoded strings; root processes spawned from ctrl-service or cmsSnmpTrap.sh.
• Behavioral: Successful administrative actions or sessions without a corresponding legitimate login; sudden configuration changes, new local accounts, or modified access policies on the appliance.
• Behavioral: DNS queries from the appliance to unusual or newly registered domains, and spikes in 4xx/5xx responses from the Work Place interface indicating probing.

Mitigation and workarounds

SonicWall has released hotfix firmware that addresses both CVE-2026-83548 and CVE-2026-83549: 12.4.3-03526 and 12.5.0-02952 for all affected SMA1000 series appliances (SMA6210, SMA7210, SMA8200V). Apply these immediately — CISA's due date for federal agencies was 2026-09-05, and the same urgency applies to any organization running an internet-facing appliance.

Interim and compensating controls if you cannot patch instantly:

• Restrict network access to the Work Place interface to authorized IP ranges only.
• Place the appliance behind a WAF or reverse proxy with strict egress filtering.
• Block outbound traffic from the appliance to internal RFC1918 ranges and cloud metadata endpoints unless explicitly required.
• Enforce least privilege on any service accounts or API tokens the appliance uses.
• Monitor for anomalous access patterns and SSRF-style request signatures in upstream proxies, WAFs, and load balancers.

Follow CISA BOD 26-04 guidance for prioritizing security updates based on risk, and complete the Forensics Triage Requirements if compromise is suspected. If mitigations are unavailable, CISA's guidance is explicit: follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product. After patching, verify by re-scanning the appliance, confirming the firmware build, and validating that the Work Place interface is no longer exposed to untrusted networks.

Community reactions

SonicWall's PSIRT published advisory SNWLID-2026-0016 alongside disclosure, urging immediate patching and noting active exploitation. Sophos published a dedicated analysis of the vulnerability chain, and Rapid7 released an Emergency Threat Response report confirming in-the-wild exploitation and detailing the attack chain, including a Metasploit module. The CVE received broad coverage from major security outlets, and community discussion highlighted the CVSS 10.0 score and the KEV listing arriving within one day of disclosure. Commentators also noted that this was the second zero-day chain affecting SMA1000 within roughly seven weeks, following a similar SSRF-to-injection pattern — a point that raises legitimate questions about the product's security posture and should factor into risk decisions for organizations that depend on it.

FAQ

Is CVE-2026-83548 in the CISA KEV catalog? Yes. CISA added it on 2026-09-02.

What is the CISA remediation due date? 2026-09-05 — a three-day window for federal agencies, which signals expected or observed exploitation.

Is the vulnerability exploitable over the internet? Yes, if the Work Place interface is internet-facing. The flaw is pre-authentication and network reachable (AV:N, PR:N, UI:N), so any exposed appliance is a candidate target.

Which products and versions are affected? SonicWall SMA1000 series appliances — SMA6210, SMA7210, and SMA8200V. Public reporting identifies firmware 12.4.3-03453 and earlier, and 12.5.0-02835 and earlier, as vulnerable. Confirm against SNWLID-2026-0016.

What is the fixed version? Hotfix firmware 12.4.3-03526 and 12.5.0-02952 address both CVE-2026-83548 and CVE-2026-83549.

How do I verify remediation? Confirm the appliance is running a fixed build, re-scan to validate the version, and verify the Work Place interface is not reachable from untrusted networks. If compromise is suspected, complete CISA's Forensics Triage Requirements before returning the device to service.

Is there a public exploit? Public analysis repositories exist on GitHub, and Rapid7 has published a Metasploit module for the chained path. KEV status means you should not wait for tooling to mature before patching.

Does this involve ransomware? CISA lists known ransomware use as unknown for this CVE. That does not reduce urgency — edge-appliance compromise is a common precursor to ransomware deployment.

Related resources

• SonicWall PSIRT advisory SNWLID-2026-0016
• CISA Known Exploited Vulnerabilities catalog — CVE-2026-83548
• NVD entry for CVE-2026-83548
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• Rapid7 ETR: Critical SonicWall SMA1000 vulnerabilities exploited in the wild
• Sophos blog: SonicWall CVE-2026-83548 and CVE-2026-83549
• GitHub Advisory GHSA-ghw2-cfh2-xvgc
• GitHub: CVE-2026-83548 SonicWall SMA1000 analysis
• GitHub: CVE-2026-83548 / CVE-2026-83549
• Wiz vulnerability database: CVE-2026-83548
• Beazley Labs advisory BSL-A1201