CVE-2026-83548

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.

Critical Known exploited

Severity: 10.0 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 8.04%; Chance of exploitation in the next 30 days. Higher than 94.79% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Sep 2, 2026
Weakness: CWE-441 Unintended Proxy or Intermediary ('Confused Deputy'); CWE-918 Server-Side Request Forgery (SSRF)
Fix: None yet; No fixed version published

Exploited in the wild. SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (SonicWall SMA1000 Appliances). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Sep 5, 2026.

Description

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

How to prevent it

Architecture and Design: Enforce the use of strong mutual authentication mechanism between the two parties.
Architecture and Design: Whenever a product is an intermediary or proxy for transactions between two other components, the proxy core should not drop the identity of the initiator of the transaction. The immutability of the identity of the initiator must be maintained and should be forwarded all the way to the target.

CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

Advisories

psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016

Timeline

Sep 1, 2026 Published
Sep 2, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Sep 3, 2026 Last updated by the source
Sep 5, 2026 Remediation due for U.S. federal agencies
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-7hp6-4w63-5g45 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key	Critical	Same weakness, CWE-441
GHSA-jmqq-x5g9-9p2w AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host	Critical	Same weakness, CWE-441
GHSA-29gx-h2m3-xw44 Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback	Medium	Same weakness, CWE-441
GHSA-r4gj-5m52-g5wh Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF	High	Same weakness, CWE-441
GHSA-m8m8-qj5v-23w3 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection	High	Same weakness, CWE-441
GHSA-2xj6-xx86-cwwc MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue	High	Same weakness, CWE-441
GHSA-wv8v-v4c5-v75j MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path	High	Same weakness, CWE-441
GHSA-9gm5-9rfh-m6vx CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP	High	Same weakness, CWE-441

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor