Future TechnologySonicWall CVE-2026-83548 Is Scored 10.0 and Under Active Exploitation
Key takeaways
- CVE-2026-83548 is a pre-authentication SSRF in the SonicWall SMA1000 Appliance Work Place interface, scored CVSS 10.0
- SonicWall advisory SNWLID-2026-0016, published 1 September, confirms active exploitation
- A second flaw, CVE-2026-83549 at 7.8, gives remote code execution to an attacker who already has admin
- Three other flaws in LiteLLM, Sangoma Switchvox and Redis are also being exploited or have public proof of concept code
10.0. That is the CVSS score SonicWall assigned to CVE-2026-83548, and the company confirmed on 1 September that attackers are already using it.
The advisory, SNWLID-2026-0016, covers two flaws in SMA1000 remote access appliances. CVE-2026-83548 is a pre-authentication server-side request forgery in the Appliance Work Place interface. Pre-authentication is the part that earns the perfect score. An attacker who can reach the box over the network needs no credentials, no session, and no phishing email first.
The second flaw, CVE-2026-83549, is a post-authentication command injection in the Appliance Management Console, scored 7.8. It gives remote code execution to an attacker who already holds admin. Lower score, still worth patching, and the two chain in the obvious direction.
Why a 10.0 on this device is worse than a 10.0 elsewhere
SMA1000 is a remote access appliance. Its entire job is to sit at the edge of a network and accept connections from outside. You cannot firewall it into safety the way you can with an internal service, because being reachable is the product.
Edge appliances are also the first thing attackers scan for, and they tend to be the least maintained hardware an organisation owns. Nobody logs into the VPN concentrator for months at a time. That combination is how a CVE number turns into a ransomware post-mortem three weeks later.
It is not the only one this week
Early September has been busy:
- CVE-2026-35029 in LiteLLM, with honeypots recording thousands of unauthorised requests
- CVE-2026-9586 in Sangoma Switchvox, exploited in the wild
- CVE-2026-81934, a Redis remote code execution with a public proof of concept
The Redis one deserves attention if you self-host anything. A public proof of concept means the barrier to exploitation is reading a web page.
What to do today
- Patch SMA1000 to the fixed firmware listed in SNWLID-2026-0016. No workaround beats patching for a pre-auth flaw.
- Read the appliance logs for unexpected outbound requests. SSRF leaves traces in what the box tried to reach, not only in what reached it.
- Confirm what else you have facing the internet. Our guide to checking whether a server is exposed is the quick version of that audit.
- Cross-reference your kit against the CISA KEV catalog weekly instead of waiting for a vendor email.
The Zimbra CVE-2026-73570 case followed the same shape earlier this year: an edge-facing service, a public advisory, and a gap between disclosure and patching that attackers filled. The gap is the only variable you control.