# CVE-2026-83548: SonicWall SMA1000 server-side request forgery

Source: https://junglewise.ai/threats/cve-2026-83548-sonicwall-sma1000-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-83548 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-09-01

SonicWall SMA1000 is a secure remote access appliance used to provide VPN connectivity for enterprise employees. A server-side request forgery vulnerability allows unauthenticated attackers to bypass security controls and access sensitive internal functionality, potentially compromising the integrity of remote access systems and enabling lateral movement into corporate networks.

Technologies: [SonicWall SMA1000 Appliances](https://junglewise.ai/threats/technologies/sma1000-appliances). Vendors: [SonicWall](https://junglewise.ai/threats/vendors/sonicwall).

## Quick answers

**Is CVE-2026-83548 exploited in the wild?** Yes. CVE-2026-83548 is known to be exploited in the wild, first recorded on 2 September 2026. Treat it as urgent.

**How severe is CVE-2026-83548?** Critical severity, with a CVSS score of 10, published 1 September 2026.

**Which products and versions are affected?** SonicWall SMA1000.

**Is there a fix for CVE-2026-83548?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-83548 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-83548?** Check whether you run SonicWall SMA1000 or SonicWall SMA1000 Appliances. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) flaw in SonicWall SMA1000 appliances that permits remote, unauthenticated attackers to forge requests to internal services. The SSRF vulnerability allows an attacker to bypass authentication controls and interact with sensitive administrative functionality without valid credentials. Attack preconditions are minimal—network access to the affected appliance is required, but no authentication is necessary. Successful exploitation enables attackers to perform unauthorized operations on the device, access configuration data, or pivot to internal network resources. Active exploitation has been reported in the wild. Patch status should be verified through SonicWall's security advisories.

## Affected products

- SonicWall SMA1000

## Timeline

- 2026-09-02: disclosed
- exploited: Reported in active exploitation in the wild

## Related threats

- [SonicWall SMA1000 OS command injection](https://junglewise.ai/threats/cve-2026-83549-sonicwall-sma1000-os-command-injection)
- [SonicWall SMA1000 code injection in Appliance Management Console](https://junglewise.ai/threats/cve-2026-15410-sonicwall-sma1000-code-injection-in-appliance-management-console)
- [SonicWall SMA1000 SSRF in Work Place interface](https://junglewise.ai/threats/cve-2026-15409-sonicwall-sma1000-ssrf-in-work-place-interface)
- [SonicWall SMA1000 Appliances Deserialization Vulnerability](https://junglewise.ai/threats/cve-2025-23006-sonicwall-sma1000-appliances-deserialization-vulnerability)