---
title: "SMA1000 SSRF Check (CVE-2026-83548)"
canonical: https://trickest.com/library/sonicwall-sma1000-ssrf-check-cve-2026-83548
description: "Point hosts at SonicWall SMA 1000 and flag CVE-2026-83548 by hotfix, then confirm with a GET of /wsproxy. No destination URL."
---

# SMA1000 SSRF Check (CVE-2026-83548)

## Overview

This workflow finds SonicWall SMA 1000 and sorts each host by whether its hotfix falls in the CVE-2026-83548 range. CVE-2026-83548 is pre-authentication SSRF through an unintended forward proxy on the Appliance Workplace. SonicWall says the flaw is in use. It is not on the CISA KEV list as of 2 September 2026. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the Workplace surface, reads the hotfix from `/__api/v2/about`, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). Version flag is first. Hosts in range get a second node that GETs `/wsproxy` with no query string. It does not send a destination URL.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as SMA 1000 from the public Workplace page, then compare the hotfix to the CVE-2026-83548 floors in the graph.
3. Confirm only those flagged hosts with an unauthenticated GET of `/wsproxy`. It does not send a destination URL.
4. Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.

## Inputs

- **Target list.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a `url` field also works. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether SMA 1000 was detected, the hotfix read, the affected flag, and whether `/wsproxy` answered without a destination.
- **summary.json.** Counts across the list: targets, product hits, affected, confirmed, and errors.

## Integrations

- HTTP. Unauthenticated GET to the Workplace about page and, on flagged hosts only, `/wsproxy` with no query string. No destination URL.

## Sample output

The records below are illustrative and do not come from a real run. They show one SMA 1000 host inside the CVE-2026-83548 range, one patched host, and one host that is not the product.

```jsonl
{"target_url": "https://vpn.example.com", "product_detected": true, "version": "12.4.3-03453", "affected": true, "confirmed": true, "error": null}
{"target_url": "https://vpn.example.org", "product_detected": true, "version": "12.4.3-03526", "affected": false, "confirmed": false, "error": null}
{"target_url": "https://shop.example.net", "product_detected": false, "version": null, "affected": false, "confirmed": false, "error": "not_product"}
```

```json
{"cve": "CVE-2026-83548", "total_targets": 3, "affected": 1, "not_affected": 1, "errors": 1}
```

## FAQ

### Which SMA 1000 versions does this flag?

SMA 1000 12.4.3 before hotfix 03526, and 12.5.0 before hotfix 02952. Models 6210, 7210, and 8200v. SMA 100 and firewall SSL-VPN are out of scope. The compare uses the hotfix the product itself served.

### Does a confirmed row mean SSRF ran?

No. Confirm only GETs `/wsproxy` with no query string. It does not send a destination URL and it does not open a WebSocket tunnel. A confirmed row means the Workplace proxy path still answers.

### Is this check safe on production?

Yes. Fingerprint is read-only GET. Confirm is an unauthenticated GET of `/wsproxy`, only on hosts already in range. It does not log in or make the appliance fetch a URL.

### Does the check need credentials?

No. It fingerprints the public Workplace page the way an external scanner would.

### What is CVE-2026-83548?

Pre-authentication SSRF through an unintended forward proxy on the SMA 1000 Workplace. SonicWall says it is in use. This workflow flags by hotfix, then confirms the `/wsproxy` surface without a destination.

## Related workflows

- [Jenkins CLI File Read (CVE-2024-23897)](/library/jenkins-path-traversal-check-cve-2024-23897). Reach for it when the next confirm is also a surface GET, not an exploit.
- [Ivanti Auth Bypass (CVE-2023-46805)](/library/ivanti-auth-bypass-check-cve-2023-46805). Reach for it when the next gateway is Ivanti Connect Secure, not SMA 1000.
- [TeamCity Auth Bypass (CVE-2024-27198)](/library/teamcity-auth-bypass-check-cve-2024-27198). Reach for it when the next confirm is a GET through a bypass path, with no write.

---
_Markdown source of https://trickest.com/library/sonicwall-sma1000-ssrf-check-cve-2026-83548._