Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Detect
Fingerprints SMA 1000 and flags CVE-2026-83548 by hotfix. No probe.
Confirm
GET /wsproxy. No destination URL.
Collect
Merges per-host detect and confirm rows.
Report
Counts checked, product, affected, and confirmed.
Overview
This workflow finds SonicWall SMA 1000 and sorts each host by whether its hotfix falls in the CVE-2026-83548 range. CVE-2026-83548 is pre-authentication SSRF through an unintended forward proxy on the Appliance Workplace. SonicWall says the flaw is in use. It is not on the CISA KEV list as of 2 September 2026. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the Workplace surface, reads the hotfix from /__api/v2/about, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. Version flag is first. Hosts in range get a second node that GETs /wsproxy with no query string. It does not send a destination URL. Same honesty as the Jenkins CLI surface check.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as SMA 1000 from the public Workplace page, then compare the hotfix to the CVE-2026-83548 floors in the graph.
Confirm only those flagged hosts with an unauthenticated GET of /wsproxy. It does not send a destination URL.
Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether SMA 1000 was detected, the hotfix read, the affected flag, and whether /wsproxy answered without a destination.
summary.json. Counts across the list: targets, product hits, affected, confirmed, and errors.
Integrations
HTTP. Unauthenticated GET to the Workplace about page and, on flagged hosts only, /wsproxy with no query string. No destination URL.
Sample output
The records below are illustrative and do not come from a real run. They show one SMA 1000 host inside the CVE-2026-83548 range, one patched host, and one host that is not the product.
SMA 1000 12.4.3 before hotfix 03526, and 12.5.0 before hotfix 02952. Models 6210, 7210, and 8200v. SMA 100 and firewall SSL-VPN are out of scope. The compare uses the hotfix the product itself served.
Does a confirmed row mean SSRF ran?
No. Confirm only GETs /wsproxy with no query string. It does not send a destination URL and it does not open a WebSocket tunnel. A confirmed row means the Workplace proxy path still answers.
Is this check safe on production?
Yes. Fingerprint is read-only GET. Confirm is an unauthenticated GET of /wsproxy, only on hosts already in range. It does not log in or make the appliance fetch a URL.
Does the check need credentials?
No. It fingerprints the public Workplace page the way an external scanner would.
What is CVE-2026-83548?
Pre-authentication SSRF through an unintended forward proxy on the SMA 1000 Workplace. SonicWall says it is in use. This workflow flags by hotfix, then confirms the /wsproxy surface without a destination.