High severity7.2NVD Advisory· Published Apr 9, 2026· Updated May 14, 2026

CVE-2026-4116

Description

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.

Affected products

SonicWall/Sma8200v
cpe:2.3:a:sonicwall:sma8200v:*:*:*:*:*:*:*:*
Range: <12.4.3-03387
SonicWall/Sma6200 Firmware
cpe:2.3:o:sonicwall:sma6200_firmware:*:*:*:*:*:*:*:*
Range: <12.4.3-03387
SonicWall/Sma7210 Firmware2 versions
cpe:2.3:o:sonicwall:sma6210_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:sonicwall:sma6210_firmware:*:*:*:*:*:*:*:*range: <12.4.3-03387
- cpe:2.3:o:sonicwall:sma7210_firmware:*:*:*:*:*:*:*:*range: <12.4.3-03387
SonicWall/Sma7200 Firmware
cpe:2.3:o:sonicwall:sma7200_firmware:*:*:*:*:*:*:*:*
Range: <12.4.3-03387
SonicWall/SMA1000 seriesllm-fuzzy

Patches

Vulnerability mechanics

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0003nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000