SonicWall SMA1000 Server-Side Request Forgery Exploitation (CVE-2026-83548)

let smaAppliances = dynamic(["sma1000", "sslvpn", "sma-appliance"]);
let metadataIps = dynamic(["169.254.169.254", "100.100.100.200", "fd00:ec2::254"]);
CommonSecurityLog
| where DeviceVendor =~ "SonicWall"
| where DeviceProduct has_any ("SMA1000", "SMA 1000", "Secure Mobile Access")
| where DestinationIP in (metadataIps)
    or (ipv4_is_private(DestinationIP) and DestinationPort in (80, 443, 8080, 8443, 22, 3389, 6379, 9200, 2379))
| extend SsrfTarget = DestinationIP
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP = SsrfTarget, DestinationPort, RequestURL, DeviceAction, Message
| summarize RequestCount = count(), Targets = make_set(DestinationIP, 50), Ports = make_set(DestinationPort, 20) by SourceIP, bin(TimeGenerated, 15m)
| where RequestCount > 5 or array_length(Targets) > 3
| order by RequestCount desc

index=network sourcetype="sonicwall:sma" OR sourcetype="cisco:asa" (vendor="SonicWall" OR product="SMA1000")
| eval is_metadata=if(dest_ip IN ("169.254.169.254","100.100.100.200"),1,0)
| eval is_internal=if(cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip),1,0)
| where is_metadata=1 OR (is_internal=1 AND dest_port IN (80,443,8080,8443,22,3389,6379,9200,2379))
| stats count AS request_count dc(dest_ip) AS distinct_targets values(dest_ip) AS targets values(dest_port) AS ports by src_ip, _time span=15m
| where request_count>5 OR distinct_targets>3
| sort - request_count

network where event.dataset : "sonicwall.sma*" and source.vendor : "SonicWall" and
  (
    destination.ip in ("169.254.169.254", "100.100.100.200") or
    (
      (cidrMatch(destination.ip, "10.0.0.0/8") or cidrMatch(destination.ip, "172.16.0.0/12") or cidrMatch(destination.ip, "192.168.0.0/16")) and
      destination.port in (80, 443, 8080, 8443, 22, 3389, 6379, 9200, 2379)
    )
  )

SELECT sourceip, destinationip, destinationport, QIDNAME(qid) AS event_name, COUNT(*) AS request_count, UNIQUECOUNT(destinationip) AS distinct_targets FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%SonicWall%' AND (destinationip = '169.254.169.254' OR destinationip = '100.100.100.200' OR ((INCIDR('10.0.0.0/8', destinationip) OR INCIDR('172.16.0.0/12', destinationip) OR INCIDR('192.168.0.0/16', destinationip)) AND destinationport IN (80, 443, 8080, 8443, 22, 3389, 6379, 9200, 2379))) GROUP BY sourceip HAVING request_count > 5 OR distinct_targets > 3 LAST 1 HOURS

_sourceCategory=*sonicwall*sma* OR _sourceCategory=*firewall*
| where vendor = "SonicWall" and product matches "*SMA1000*"
| if(dest_ip in ("169.254.169.254","100.100.100.200"), 1, 0) as is_metadata
| if(compareCIDRPrefix("10.0.0.0", dest_ip, toInt(8)) or compareCIDRPrefix("172.16.0.0", dest_ip, toInt(12)) or compareCIDRPrefix("192.168.0.0", dest_ip, toInt(16)), 1, 0) as is_internal
| where is_metadata = 1 or (is_internal = 1 and dest_port in (80,443,8080,8443,22,3389,6379,9200,2379))
| count as request_count, count_distinct(dest_ip) as distinct_targets by src_ip, _timeslice(15m)
| where request_count > 5 or distinct_targets > 3
| sort by request_count desc

rule sonicwall_sma1000_ssrf_cve_2026_83548 {
  meta:
    author = "Argus Detection Platform"
    description = "SonicWall SMA1000 SSRF exploitation (CVE-2026-83548) - appliance-sourced requests to metadata or internal services"
    severity = "HIGH"
    cve = "CVE-2026-83548"
  events:
    $net.metadata.vendor_name = "SonicWall"
    $net.metadata.product_name = /SMA ?1000|Secure Mobile Access/
    $net.principal.ip = $src
    (
      $net.target.ip = "169.254.169.254" or
      $net.target.ip = "100.100.100.200" or
      (
        net.ip_in_range_cidr($net.target.ip, "10.0.0.0/8") or
        net.ip_in_range_cidr($net.target.ip, "172.16.0.0/12") or
        net.ip_in_range_cidr($net.target.ip, "192.168.0.0/16")
      )
    )
  match:
    $src over 15m
  condition:
    #net > 5
}

#event_simpleName=NetworkConnectIP4 OR #repo="sonicwall_sma"
| vendor="SonicWall" AND product=/SMA ?1000/
| case {
    RemoteAddressIP4="169.254.169.254" | is_metadata:=1;
    RemoteAddressIP4="100.100.100.200" | is_metadata:=1;
    * | is_metadata:=0;
  }
| ipLocation(RemoteAddressIP4)
| in(field=RemotePort, values=[80,443,8080,8443,22,3389,6379,9200,2379])
| cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"], negate=false) OR is_metadata=1
| groupBy([aid, RemoteAddressIP4], function=count(as=request_count))
| request_count > 5