Vulnerability

CVE-2026-83548

Server-side request forgery vulnerability in the SonicWall SMA1000 WorkPlace interface usable to bypass authentication.

Current stories

securityConfirmed4 publishers

SonicWall patches a third pre-auth SSRF flaw in SMA 1000 gateways this year

SonicWall patched four flaws in its SMA 1000 VPN gateways, led by CVE-2026-102255, a server-side request forgery open to remote attackers without credentials. The company reports no exploitation, though attackers used two similar SMA 1000 flaws as zero-days this year.

Publishers:bleepingcomputer.com helpnetsecurity.com securityaffairs.com thehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 23%
Operator: Operator 67%
Investor: Investor 10%

Reality

Evidence72
Adoption30
Hype gap+8
Incentives: Not scored
Confidence70

securityConfirmed4 publishers

CISA's seven new KEV entries put SonicWall gateways and Artifactory on one patch clock

SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.

Publishers:blog.rapid7.com cisa.gov scworld.com thehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 14%
Operator: Operator 72%
Investor: Investor 14%

Reality

Evidence70
Adoption: Not scored
Hype gap+10
Incentives35
Confidence68

buildOne report1 publisher

Chaining a 10.0 portal SSRF to a 7.8 console injection gets OS execution on SonicWall's SMA1000

SonicWall confirmed both SMA1000 flaws were exploited before disclosure, and CISA gave federal agencies three days to remediate. The lower-scored console bug is the step that reaches the operating system.

Publishers:dev.to

Reality

Evidence55
Adoption60
Hype gap+8
Incentives35
Confidence48

buildOne report1 publisher

CISA gave federal SonicWall SMA 1000 operators three days to patch a pre-auth SSRF

SonicWall shipped fixed builds on the day the two flaws were disclosed, so the September 5 deadline tested patch cadence. One measurement service's product fingerprint finds seven SMA appliances; a certificate match on the vendor name finds 2,295,225.

Publishers:dev.to

Reality

Evidence55
Adoption30
Hype gap+12
Incentives60
Confidence48

securityOne report1 publisher

Metasploit packages the SonicWall SMA1000 root chain into one module

Sixteen new modules landed in the framework, ten of them exploits, and Rapid7 counts five of those against CISA's exploited list. The SonicWall entry runs September's zero-day chain from SSRF to root.

Publishers:blog.rapid7.com

Reality

Evidence64
Adoption55
Hype gap+12
Incentives74
Confidence62