SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

cve CVE-2026-83548 2 sources, 2 claims · Watch

CISA Known Exploited Vulnerabilities writes:
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or disconti… the claim

What each source says

Property	Source	Said	Means here
Cwes cwes	CISA Known Exploited Vulnerabilities	CWE-918, CWE-441 receipt Source CISA Known Exploited Vulnerabilities Its words `CWE-918, CWE-441` Read by `field:cwes` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 14:19 UTC What the source handed over { "cveID": "CVE-2026-83548", "cwes": "CWE-918, CWE-441", "dateAdded": "2026-09-02", "dueDate": "2026-09-05", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548", "product": "SMA1000 Appliances", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "vendorProject": "SonicWall", "vulnerabilityName": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability" }	—
Due date due_date	CISA Known Exploited Vulnerabilities	2026-09-05 receipt Source CISA Known Exploited Vulnerabilities Its words `2026-09-05` Read by `field:dueDate` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 14:19 UTC What the source handed over { "cveID": "CVE-2026-83548", "cwes": "CWE-918, CWE-441", "dateAdded": "2026-09-02", "dueDate": "2026-09-05", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548", "product": "SMA1000 Appliances", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "vendorProject": "SonicWall", "vulnerabilityName": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability" }	—
Exploited exploited	CISA Known Exploited Vulnerabilities	yes receipt Source CISA Known Exploited Vulnerabilities Its words `yes` Read by `const:yes` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 14:19 UTC What the source handed over { "cveID": "CVE-2026-83548", "cwes": "CWE-918, CWE-441", "dateAdded": "2026-09-02", "dueDate": "2026-09-05", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548", "product": "SMA1000 Appliances", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "vendorProject": "SonicWall", "vulnerabilityName": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability" }	—
Forensic triage forensic_triage	CISA Known Exploited Vulnerabilities	true receipt Source CISA Known Exploited Vulnerabilities Its words `Yes` Read by `field:forensicTriage` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 14:19 UTC What the source handed over { "cveID": "CVE-2026-83548", "cwes": "CWE-918, CWE-441", "dateAdded": "2026-09-02", "dueDate": "2026-09-05", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548", "product": "SMA1000 Appliances", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "vendorProject": "SonicWall", "vulnerabilityName": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability" }	—
Known ransomware campaign use known_ransomware_campaign_use	CISA Known Exploited Vulnerabilities	Unknown receipt Source CISA Known Exploited Vulnerabilities Its words `Unknown` Read by `field:knownRansomwareCampaignUse` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 14:19 UTC What the source handed over { "cveID": "CVE-2026-83548", "cwes": "CWE-918, CWE-441", "dateAdded": "2026-09-02", "dueDate": "2026-09-05", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548", "product": "SMA1000 Appliances", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "vendorProject": "SonicWall", "vulnerabilityName": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability" }	—
Platform platform	Metasploit exploit modules	Linux,Unix receipt Source Metasploit exploit modules Its words `Linux,Unix` Read by `field:platform` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 14:23 UTC Original open at the source What the source handed over { "aliases": [], "arch": "cmd", "author": [ "sfewer-r7", "William Perry", "Adam Babis" ], "autofilter_ports": [ 80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443 ], "autofilter_services": [ "http", "https" ], "check": true, "default_credential": false, "description": "This module chains three issues in SonicWall SMA1000 appliances. An\n unauthenticated, absolute-form OPTIONS request makes the WorkPlace\n listener act as an unintended forward proxy (CVE-2026-83548). The\n module uses this access and a vendor-installed CouchDB update handler\n to obtain read and write access to loopback CouchDB (SMA1000-9427),\n then enables CouchDB's native Erlang query server and executes one\n command as the couchdb service account.\n\n That command derives the appliance-local ctrl-service credential and\n invokes sysCtrl.execCmsSnmpTrap. A command injection in the SNMP trap\n script (CVE-2026-83549) executes the selected command as root.\n\n The module attempts to restore the original CouchDB logger\n configuration, remove its injected INI data, disable the Erlang query\n server, and delete its randomized CouchDB documents. SonicWall fixed\n the issues in platform hotfixes 12.4.3-03526 and 12.5.0-02952.", "disclosure_date": "2026-09-01", "fullname": "exploit/linux/http/sonicwall_sma1000_couchdb_rce", "is_install_path": true, "mod_time": "2026-09-09 15:07:31 +0000", "name": "SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution", "needs_cleanup": null, "notes": { "Reliability": [ "repeatable-session" ], "SideEffects": [ "artifacts-on-disk", "config-changes", "ioc-in-logs" ], "Stability": [ "crash-service-restarts" ] }, "path": "/modules/exploits/linux/http/sonicwall_sma1000_couchdb_rce.rb", "platform": "Linux,Unix", "post_auth": false, "rank": 500, "ref_name": "linux/http/sonicwall_sma1000_couchdb_rce", "references": [ "CVE-2026-83548", "CVE-2026-83549", "URL-https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "URL-https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities-snwlid-2026-0016/kA1VN000002AXmQ0AW", "URL-https://software.sonicwall.com/PFORMSMAHOTFIX/Documentation/TechNotepform-hotfix-12.5.0-02952.txt", "URL-https://www.rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild/" ], "rport": 443, "session_types": false, "targets": [ "Linux Command" ], "type": "exploit" }	—
Product product	CISA Known Exploited Vulnerabilities	SMA1000 Appliances receipt Source CISA Known Exploited Vulnerabilities Its words `SMA1000 Appliances` Read by `field:product` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 14:19 UTC What the source handed over { "cveID": "CVE-2026-83548", "cwes": "CWE-918, CWE-441", "dateAdded": "2026-09-02", "dueDate": "2026-09-05", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548", "product": "SMA1000 Appliances", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "vendorProject": "SonicWall", "vulnerabilityName": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability" }	—
Rank rank	Metasploit exploit modules	500 Great. Detects the target automatically, or uses an application-specific return address. receipt Source Metasploit exploit modules Its words `500` Read by `field:rank` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 14:23 UTC Original open at the source What the source handed over { "aliases": [], "arch": "cmd", "author": [ "sfewer-r7", "William Perry", "Adam Babis" ], "autofilter_ports": [ 80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443 ], "autofilter_services": [ "http", "https" ], "check": true, "default_credential": false, "description": "This module chains three issues in SonicWall SMA1000 appliances. An\n unauthenticated, absolute-form OPTIONS request makes the WorkPlace\n listener act as an unintended forward proxy (CVE-2026-83548). The\n module uses this access and a vendor-installed CouchDB update handler\n to obtain read and write access to loopback CouchDB (SMA1000-9427),\n then enables CouchDB's native Erlang query server and executes one\n command as the couchdb service account.\n\n That command derives the appliance-local ctrl-service credential and\n invokes sysCtrl.execCmsSnmpTrap. A command injection in the SNMP trap\n script (CVE-2026-83549) executes the selected command as root.\n\n The module attempts to restore the original CouchDB logger\n configuration, remove its injected INI data, disable the Erlang query\n server, and delete its randomized CouchDB documents. SonicWall fixed\n the issues in platform hotfixes 12.4.3-03526 and 12.5.0-02952.", "disclosure_date": "2026-09-01", "fullname": "exploit/linux/http/sonicwall_sma1000_couchdb_rce", "is_install_path": true, "mod_time": "2026-09-09 15:07:31 +0000", "name": "SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution", "needs_cleanup": null, "notes": { "Reliability": [ "repeatable-session" ], "SideEffects": [ "artifacts-on-disk", "config-changes", "ioc-in-logs" ], "Stability": [ "crash-service-restarts" ] }, "path": "/modules/exploits/linux/http/sonicwall_sma1000_couchdb_rce.rb", "platform": "Linux,Unix", "post_auth": false, "rank": 500, "ref_name": "linux/http/sonicwall_sma1000_couchdb_rce", "references": [ "CVE-2026-83548", "CVE-2026-83549", "URL-https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "URL-https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities-snwlid-2026-0016/kA1VN000002AXmQ0AW", "URL-https://software.sonicwall.com/PFORMSMAHOTFIX/Documentation/TechNotepform-hotfix-12.5.0-02952.txt", "URL-https://www.rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild/" ], "rport": 443, "session_types": false, "targets": [ "Linux Command" ], "type": "exploit" }	—
Vendor project vendor_project	CISA Known Exploited Vulnerabilities	SonicWall receipt Source CISA Known Exploited Vulnerabilities Its words `SonicWall` Read by `field:vendorProject` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 14:19 UTC What the source handed over { "cveID": "CVE-2026-83548", "cwes": "CWE-918, CWE-441", "dateAdded": "2026-09-02", "dueDate": "2026-09-05", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548", "product": "SMA1000 Appliances", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "vendorProject": "SonicWall", "vulnerabilityName": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability" }	—

vulnerability

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

zetlyn/cve-kev · 2026-09-02

cwes CWE-918, CWE-441 due_date 2026-09-05 exploited yes forensic_triage true known_ransomware_campaign_use Unknown product SMA1000 Appliances vendor_project SonicWall

exploit

SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution

zetlyn/cve-metasploit · 2026-09-01

platform Linux,Unix rank 500

source