What is the CVSS score of CVE-2026-4113?

CVE-2026-4113 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sonicwall are affected by CVE-2026-4113?

SonicWall SMA1000 SSL VPN appliances contain a credential enumeration vulnerability (CVE-2026-4113) that allows authenticated administrators to discover valid user accounts through timing-based…

How to fix or mitigate CVE-2026-4113?

Within 24 hours: Identify all SonicWall SMA1000 appliances in production and document current firmware versions. Within 7 days: Restrict administrative access to SMA1000 devices to named, trusted administrators only and enable multi-factor authentication for admin accounts; monitor authentication logs for suspicious enumeration patterns. Within 30 days: Contact SonicWall for available firmware updates beyond versions 12.4.3-03245 and 12.5.0-02283 and plan upgrade testing; if patches are released, schedule deployment to all affected appliances.

Sonicwall CVE-2026-4113

EUVD-2026-20904 HIGH

Observable Response Discrepancy (CWE-204)

2026-04-09 sonicwall

GHSA-fvcv-8g7r-6893

Information Disclosure Sonicwall

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:28 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

7.2 (HIGH)

EUVD ID Assigned

Apr 09, 2026 - 15:00 euvd

EUVD-2026-20904

CVE Published

Apr 09, 2026 - 14:23 nvd

N/A

DescriptionCVE.org

An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.

AnalysisAI

SonicWall SMA1000 SSL VPN appliances allow remote authenticated administrators to enumerate valid user credentials through observable timing or response differences. Affects SMA1000 versions 12.4.3-03245 and earlier, plus 12.5.0-02283 and earlier. While CVSS rates this 7.2 High, real-world risk is moderate: exploitation requires existing high-privilege access (PR:H), EPSS shows only 0.04% probability (11th percentile), and no active exploitation or public POC identified at time of analysis. The vulnerability enables credential harvesting for subsequent lateral movement attacks.

Technical ContextAI

This is a CWE-204 Observable Response Discrepancy vulnerability, commonly known as a timing side-channel or oracle attack. The SMA1000 series SSL VPN authentication mechanism leaks information about valid versus invalid usernames through measurable differences in response timing, error messages, or HTTP status codes. Attackers can distinguish between 'user exists but wrong password' versus 'user does not exist' scenarios. The affected product is SonicWall's Secure Mobile Access 1000 series (CPE: cpe:2.3:a:sonicwall:sma1000), enterprise-grade SSL VPN appliances providing remote access gateway services. Observable discrepancies in authentication flows are particularly dangerous in VPN contexts because they convert brute-force attacks into efficient enumeration, reducing attack space from username-password combinations to just passwords for confirmed valid accounts.

RemediationAI

Upgrade SMA1000 appliances to patched firmware versions released by SonicWall addressing SNWLID-2026-0003. Consult the official Product Security Incident Response Team advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0003 for exact fixed versions superseding 12.4.3-03245 and 12.5.0-02283. As interim mitigations until patching, restrict administrative interface access to trusted management networks via firewall rules, enforce multi-factor authentication for all admin accounts, implement rate-limiting on authentication endpoints, and monitor authentication logs for unusual enumeration patterns (sequential login attempts with varying usernames). Review admin account provisioning to ensure least-privilege principles and disable unnecessary administrative accounts.