CISA Adds SonicWall SMA1000 SSRF Vulnerability to KEV List

## Overview CISA added CVE-2026-83548 to its Known Exploited Vulnerabilities (KEV) list on September 2, 2026. This vulnerability affects SonicWall SMA1000 Appliances and involves a server-side request forgery (SSRF) in the Work Place interface. The addition to the KEV list suggests that exploitation is occurring in the wild, prompting a federal deadline for remediation. ## Technical Details The vulnerability arises from an unintended alternate access path that allows a remote unauthenticated attacker to exploit the system. The flaw exists before authentication, meaning attackers do not need valid credentials to initiate an attack. This SSRF vulnerability can be leveraged to gain unauthorized access to sensitive functionality within the appliance. ## Impact Successful exploitation of CVE-2026-83548 can lead to unauthorized operations on the SMA1000 Appliances. Attackers could potentially access sensitive data or manipulate the appliance's functionality without detection. Given the critical CVSS score of 10.0, the risk to organizations using these appliances is severe, necessitating immediate action. ## Mitigation Defenders should prioritize applying patches released by SonicWall to address this vulnerability. Organizations should also review their network configurations and access controls to limit exposure. Continuous monitoring for unusual activity related to the SMA1000 Appliances is recommended to detect potential exploitation attempts.