SonicWall SMA1000 WorkPlace SSRF Exploitation Attempt (CVE-2026-83548)

Ankit Mehta@Secvyn

•updated Sep 25, 2026•0•0•10

Detects Server-Side Request Forgery (SSRF) attempts targeting SonicWall SMA1000 WorkPlace endpoints. The rule monitors both HTTP GET query parameters and HTTP request bodies for patterns indicating attempts to redirect the application to internal loopback addresses or local network ranges (e.g., 127.0.0.1, 169.254.169.254, RFC1918 private subnets).