CVE-2026-83548: Second SMA1000 WorkPlace zero-day of 2026, chained for code execution

What it is

The SMA1000 WorkPlace interface has an “unintended alternate access path” that works as a forward proxy. A remote attacker with no account can use it to make the appliance send requests on their behalf. That reaches internal functionality that should never be exposed (CWE-918 server-side request forgery and CWE-441 “confused deputy”, per SonicWall).

On its own the SSRF reaches internal functions. SonicWall says it was exploited together with CVE-2026-83549, a command injection in the Appliance Management Console that needs admin access. Together they give an unauthenticated attacker operating system commands on the VPN gateway.

SonicWall credits its own researchers with finding the flaws and says it investigated a case of active exploitation, so the chain was used before a fix existed. SonicWall hasn’t shared details of the attack, and no public proof of concept was known when Rapid7 reviewed it.

This is the second pre-auth SSRF in the same interface in seven weeks. In July, CVE-2026-15409 let attackers tunnel through /wsproxy to internal services, chained with a root escalation, and it was later used by INC ransomware. Appliances that installed July’s fix (12.4.3-03453 or 12.5.0-02835) are still vulnerable to this one.

Am I affected?

You’re affected if you run an SMA1000 6210, 7210 or 8200v on:

• 12.4.3-03453 (platform-hotfix) or older, or
• 12.5.0-02835 (platform-hotfix) or older.

That includes appliances patched in July for CVE-2026-15409. The attack needs only network access to the WorkPlace interface. When the advisory came out, Shadowserver tracked more than 400 SMA1000 appliances on the internet (via BleepingComputer).

SSL-VPN on SonicWall firewalls and the SMA 100 Series are not affected.

What to do

1. Install the newest hotfix: 12.4.3-03670 or 12.5.0-03082 (or later) from MySonicWall. September’s 12.4.3-03526 and 12.5.0-02952 fix this CVE. But on October 6, SonicWall fixed a near-identical pre-auth SSRF, CVE-2026-102255, that affects those builds too. There is no workaround.

2. Confirm the installed build on every appliance after the upgrade, and find any appliance whose WorkPlace interface is reachable from the internet (Field Effect).

3. Check for compromise. SonicWall asks customers to contact SonicWall Technical Support for a review of the appliance for indicators of compromise. Do this even if you patched on September 1, because the flaw was exploited before the advisory.

4. If you find signs of compromise, SonicWall says to:

• Re-image hardware appliances, or redeploy virtual ones.
• Change all user and administrator passwords.
• Reset TOTP tokens.

Field Effect also advises rotating service credentials and widening the investigation to systems reachable through the appliance, such as admin, virtualization and network management tools.

Detection

SonicWall hasn’t published log patterns for this CVE. Until it does:

• Ask SonicWall support to review your appliance logs and files.
• Review admin activity on the appliance: new admin accounts, changes to authentication settings or access policies, and unusual remote sessions (Field Effect).
• Review authentication from the appliance to AD, LDAP, identity providers and SSO. Look for logons that don’t match a user’s VPN session (Field Effect).
• Run the July checks too. The July attacks used the same WorkPlace interface, and their traces are well documented (SonicWall, Volexity): requests to /__api__/login or /__api__/logout with status 200 in /var/log/aventail/extraweb_access.log; /wsproxy requests with status 101 to 0.0.0.0 or localhost; path-traversal names in hotfix removals in /var/log/aventail/ctrl-service.log; unexpected routes in /var/lib/unit/conf.json; and unexpected setuid binaries (find / -perm -4000). These are not confirmed indicators for CVE-2026-83548, but finding any of them on an SMA1000 means it is compromised. See CVE-2026-15409 for the full list.