Our automated tracking framework flagged that CISA added CVE-2026-83548 (SonicWall SMA1000 Appliances) to the Known Exploited Vulnerabilities (KEV) catalog on September 4, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-83548 by September 5, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-83548 |
| Vendor / product | SonicWall SMA1000 Appliances |
| Vulnerability | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| CVSS base score | 10 |
| Added to KEV | September 2, 2026 |
| Days public before listing (NVD → KEV lag) | 1 |
| Federal patch deadline | September 5, 2026 |
| Known ransomware use | No |
How This Compares to SonicWall’s Track Record
This one was public for just 1 days before CISA confirmed exploitation — faster than SonicWall’s 197-day median, meaning attackers moved unusually quickly. SonicWall currently ranks #24 on our KEV Lag leaderboard.
| SonicWall in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 19 |
| Median lag (public → KEV listing) | 197 days |
| 0-day rate (exploited at or before disclosure) | 16% |
| Entries tied to known ransomware campaigns | 10 |
For perspective, the median across all 1694 tracked KEV entries is 262 days — SonicWall’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent SonicWall KEV Additions
The most recent SonicWall vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-83549 | SMA1000 Appliances | September 2, 2026 | 1 | No |
| CVE-2026-15409 | SMA1000 Appliances | July 14, 2026 | 0 | No |
| CVE-2026-15410 | SMA1000 Appliances | July 14, 2026 | 0 | No |
| CVE-2025-40602 | SMA1000 appliance | December 17, 2025 | -1 | No |
| CVE-2023-44221 | SMA100 Appliances | May 1, 2025 | 513 | No |
What This Means for Defenders
CISA has added CVE-2026-83548, a critical Server-Side Request Forgery (SSRF) vulnerability in SonicWall SMA1000 Appliances, to its Known Exploited Vulnerabilities (KEV) catalog. With a CVSS base score of 10, this flaw demands immediate attention. Organizations using SonicWall SMA1000 appliances are directly exposed and should patch before the federal deadline of 2026-09-05. The short turnaround from its KEV listing on 2026-09-02 shows its severe risk.
CVE-2026-83548 was public for only one day before its KEV catalog inclusion, indicating adversaries were quick to weaponize it. This leaves a narrow window for detection and remediation. While there’s no known ransomware use reported for this CVE, its critical nature and confirmed exploitation make it a prime target for initial access.
If patching before the 2026-09-05 deadline isn’t feasible, organizations must implement compensating controls. Isolate affected devices, restrict network access to only essential services and trusted sources, and enhance monitoring for unusual activity originating from or targeting SMA1000 appliances. Incident response plans should be ready for activation.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
