#ssrf

2 articles

SonicWall shipped another SMA1000 SSRF and another command injection. CISA gave the last pair a three-day deadline in July

2026-09-03Security

CVE-2026-83548 is a pre-auth SSRF with a CVSS of 10.0; CVE-2026-83549 is post-auth command execution as administrator. That is the same two bug classes, in the same auth positions, on the same appliance that CISA added to KEV seven weeks ago — and both rounds are being exploited.

MLflow validated the URL, then followed a redirect and looked it up again — scanning began within hours

2026-08-19AI

CVE-2026-64849 is an unauthenticated SSRF in MLflow's webhook test endpoint, CVSS 9.3, fixed in 3.15.0. The check on the destination was real; it just was not pinned, so a redirect or a second DNS answer walked straight past it into cloud metadata. watchTowr saw exploitation attempts the same day the CVE was assigned.