InfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
90
CVE-2026-83548
Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
CISA: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- CVSS 3.1
- 10.0 critical
- EPSS
- 8%p95
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-83548 is a critical (CVSS 3.1 score 10.0) server-side request forgery (SSRF) vulnerability in the Workplace interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (unprotected alternate channel, CWE-441; SSRF, CWE-918). Because it is pre-authentication, any remote unauthenticated attacker who can reach the interface can trigger it and gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA lists all SonicWall SMA1000 appliances as affected, with CPE data naming the SMA 8200v and SMA 6210/7210 firmware; internet-exposed units are at highest risk. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-02 alongside companion zero-day CVE-2026-83549, which reporting suggests may form an attack chain with this SSRF. Exploitation probability is elevated (EPSS 4.7%, 91st percentile) and no public proof-of-concept is known.
What to do: Apply the fixes/mitigations from SonicWall security advisory AV26-872 (Update 1) immediately, prioritizing internet-exposed SMA 1000 appliances, and treat companion zero-day CVE-2026-83549 as requiring remediation in the same maintenance window. Review SMA 1000 logs for signs of exploitation (unexpected access to or requests against the Workplace interface) and reduce internet exposure of that interface where feasible. Per the CISA KEV required action and BOD 26-04, patch per vendor instructions or, where mitigations are unavailable, evaluate each asset's internet exposure and discontinue use of the product until remediated.
| Product | Affected |
|---|---|
| SonicWall SMA1000 appliance Workplace interface | — |
| SonicWall SMA 8200v | — |
| SonicWall SMA 6210 firmware | — |
| SonicWall SMA 7210 firmware | — |
Estimated exposure
moderate≈1,000–10,000 internet-exposed SMA 1000 appliances (order-of-magnitude estimate) — No published install count was in the source data; the estimate rests on SMA 1000 being SonicWall's higher-end enterprise remote-access line with a much smaller installed base than the SMB-oriented SMA 100 series, for which SonicWall has…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
KEVCISA Known Exploited Vulnerability
- Affected
- SonicWall SMA1000 Appliances
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- sonicwall
- Products
- sma8200v, sma6210 firmware, sma7210 firmware
- Weakness
- CWE-441, CWE-918
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In the news
20 storiesSonicWall Patches Two New Actively Exploited Zero
SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.
90
Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
SonicWall SMA1000 appliances face active exploitation of chained CVE-2026-83548 and CVE-2026-83549 enabling unauthenticated RCE; hotfixes released.
88
Max severity SonicWall SMA1000 flaw now exploited in attacks
Attackers exploit max-severity SonicWall SMA1000 flaw CVE-2026-102255 three days after patch; Previdian honeypots captured matching exploitation attempts.
85
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.
85
Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
SonicWall patches two actively exploited zero-days (CVE-2026-83548, CVE-2026-83549) in SMA 1000 VPN appliances, likely chained for code execution.
85
SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug
SonicWall disclosed a CVSS 10 pre-auth SSRF in SMA1000, with no confirmed exploitation yet.
82
Attackers exploit zero-days in consistently besieged SonicWall product
Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.
82
CISA Warns of SonicWall SMA1000 Vulnerabilities Active Exploitation (CVE-2026-83548 & CVE-2026-83549)
CISA added two actively exploited SonicWall SMA1000 flaws to KEV: pre-auth SSRF CVE-2026-83548 (CVSS 10) and post-auth RCE CVE-2026-83549; patch by September 5.
82
SonicWall security advisory (AV26-872) – Update 1
CISA added exploited SonicWall SMA1000 flaws CVE-2026-83548 and CVE-2026-83549 to KEV; admins of affected hotfix versions should patch.
80
SonicWall SMA 1000 appliances under attack via zero-day flaws
SonicWall confirms active exploitation of zero-day SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) flaws in SMA 1000 remote access appliances.
80
SonicWall's SMA1000 boxes under active attack again
SonicWall warns attackers are chaining two SMA1000 zero-days, a CVSS 10.0 SSRF and command injection, to compromise VPN gateways.
78
Hackers Chain Two New SonicWall Zero-Day Vulnerabilities
SonicWall warns two zero-days (CVE-2026-83548 SSRF, CVE-2026-83549 post-auth RCE) in SMA1000 appliances are being actively exploited.
78
SonicWall warns of max severity SSRF flaw in SMA1000 gateways
SonicWall patches maximum-severity unauthenticated SSRF CVE-2026-102255 in SMA1000 gateways; no exploitation reported.
76
SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10 pre-auth SSRF in SMA1000 appliances, with no evidence of exploitation.
74
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace plus three authenticated flaws.
74
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
72
SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)
SonicWall patched pre-auth SSRF CVE-2026-102255 in SMA 1000 appliances, with no known exploitation.
70
7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
70
SonicWall Patches 4 SMA1000 Flaws, Including Critical Pre-Auth SSRF Rated CVSS 10
SonicWall patched four SMA 1000 flaws, including an unauthenticated SSRF rated CVSS 10.0.
68