Critical Actively exploited

CVE-2026-83548

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

What this means

Weakness: The server issues a request to an attacker-chosen address, reaching into the internal network (SSRF).
Likelihood: Exploitation is not hypothetical: CISA has observed it in the wild.

What to doTop priority: CISA sets the remediation deadline at 5 September 2026.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published: 2 September 2026
CVSS: —
EPSS: 0.71% probability of exploitation within 30 days · above 51% of all CVEs
Weakness: CWE-918 CWE-441
CISA due date: 5 September 2026
Sources: cisa-kev

Our analysis A CVSS 10 flaw turns Kestra into an unauthenticated root shell

References

https://nvd.nist.gov/vuln/detail/CVE-2026-83548