Improper Unicode Handling in SonicWall SMA1000 Appliances
CVE-2026-4116

7.2HIGH

Key Information:

Vendor

Sonicwall
Status
Sma1000
Vendor
CVE Published:
9 April 2026

What is CVE-2026-4116?

The SonicWall SMA1000 series appliances exhibit a vulnerability due to improper handling of Unicode encoding that can be exploited by a remote authenticated SSLVPN user. This flaw allows an attacker to bypass the Time-based One-Time Password (TOTP) authentication mechanism, potentially leading to unauthorized access and compromise of sensitive information.

Affected Version(s)

SMA1000 Linux 12.4.3-03245 (platform-hotfix) and earlier versions.

SMA1000 Linux 12.5.0-02283 (platform-hotfix) and earlier versions.

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-202...
vendor-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.