High severity7.2NVD Advisory· Published Apr 9, 2026· Updated May 14, 2026

CVE-2026-4112

Description

Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.

Affected products

SonicWall/Sma8200v
cpe:2.3:a:sonicwall:sma8200v:*:*:*:*:*:*:*:*
Range: <12.4.3-03387
SonicWall/Sma6200 Firmware
cpe:2.3:o:sonicwall:sma6200_firmware:*:*:*:*:*:*:*:*
Range: <12.4.3-03387
SonicWall/Sma7210 Firmware2 versions
cpe:2.3:o:sonicwall:sma6210_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:sonicwall:sma6210_firmware:*:*:*:*:*:*:*:*range: <12.4.3-03387
- cpe:2.3:o:sonicwall:sma7210_firmware:*:*:*:*:*:*:*:*range: <12.4.3-03387
SonicWall/Sma7200 Firmware
cpe:2.3:o:sonicwall:sma7200_firmware:*:*:*:*:*:*:*:*
Range: <12.4.3-03387
SonicWall/SMA1000 seriesllm-create

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2026-4112

Description

Affected products

Patches

Vulnerability mechanics

References

News mentions