CVE-2026-83548: SonicWall SMA1000 Pre-Auth SSRF (KEV)

CVE-2026-83548 is a pre-authentication server-side request forgery in the Work Place interface of SonicWall's SMA1000 remote-access appliances, reachable via an alternate access path that bypasses the normal login, and it is on the CISA KEV catalog as actively exploited with CISA requiring forensic triage, not just patching.

CVE-2026-83548 is a Server-Side Request Forgery (CWE-918) combined with an Unintended Proxy or Intermediary (CWE-441) in the Work Place interface of SonicWall SMA1000 appliances. NVD's Analyzed record describes it as a "Pre-authentication SSRF vulnerability" that "exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path," letting a remote unauthenticated attacker "gain unauthorized access to sensitive functionality and perform unauthorized operations" (NVD).

NVD has not published its own independent Primary CVSS score for this record; the only metric on file is a CNA-submitted Secondary rating of CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, no privileges or user interaction required, scope changed, with high impact to confidentiality, integrity and availability. So the 10.0 shown here is the CNA's Secondary score, not an NVD-confirmed Primary score (NVD).

SonicWall's own PSIRT advisory page for this CVE (SNWLID-2026-0016) renders as a client-side JavaScript application with no advisory text in the initial HTML response, so it could not be read as a static source in this session; the affected-product list and fixed-version numbers below come from NVD's structured configuration data instead, which names SMA8200v (software) and the SMA6210/SMA7210 firmware as vulnerable before build 12.4.3-03526, and in the 12.5.0 branch before build 12.5.0-02952 (NVD).

CISA added CVE-2026-83548 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02, with a required-action due date of 2026-09-05 — a three-day window — and additionally marks this CVE as requiring CISA's forensic-triage guidance under BOD 26-04, a step CISA reserves for vulnerabilities it has particular concern about regarding compromise detection, not just patching (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.0804 (94.758th percentile) (FIRST EPSS).

Because the vendor's own advisory text was not readable in this session, any organization running SMA1000 appliances should treat the NVD/KEV-sourced guidance above as a starting point, confirm current firmware against SonicWall's MySonicWall portal directly, and upgrade to the fixed builds immediately given the short KEV remediation window and CISA's forensic-triage flag.

• Pre-authentication SSRF in the SonicWall SMA1000 Work Place interface via an unintended alternate access path, allowing unauthorized access to sensitive functionality. — NVD
• CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — a CNA Secondary rating; NVD has not published its own Primary score. — NVD
• Affected: SMA8200v software and SMA6210/SMA7210 firmware before build 12.4.3-03526, and 12.5.0 branch before build 12.5.0-02952 (fixed at those builds); SonicWall's own PSIRT advisory page (SNWLID-2026-0016) is a client-rendered JavaScript app with no readable advisory text in this session. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-02, required-action due date 2026-09-05, flagged for CISA's forensic-triage requirement under BOD 26-04. — CISA KEV
• EPSS score is 0.0804 (94.758th percentile) as of 2026-10-27. — FIRST EPSS