CVE-2026-83548: CWE-918 Server-Side request forgery (SSRF) in SonicWall SMA1000

This vulnerability is a pre-authentication SSRF in the SonicWall SMA1000 Appliance Work Place interface caused by an unintended alternate access path. It allows a remote unauthenticated attacker to send crafted requests that the server processes, potentially leading to unauthorized access to sensitive functions and unauthorized operations. The CVSS 3.1 base score is 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks vendor-provided remediation details or patches at this time.

An attacker can exploit this SSRF vulnerability without authentication to gain unauthorized access to sensitive functionality within the SMA1000 Appliance. This can lead to full compromise of confidentiality, integrity, and availability of the affected system, potentially allowing unauthorized operations that could disrupt services or leak sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the SMA1000 Appliance interface to trusted users only and monitor for suspicious activity. Follow SonicWall's advisories closely for updates on patches or mitigations.