What is the CVSS score of CVE-2026-4116?

CVE-2026-4116 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sonicwall are affected by CVE-2026-4116?

SonicWall SMA1000 SSL-VPN contains a two-factor authentication bypass vulnerability affecting versions 12.5.0-02283 and 12.4.3-03245 and earlier.

How to fix or mitigate CVE-2026-4116?

24 hours: Inventory all SonicWall SMA1000 appliances and document current firmware versions; contact SonicWall support for patch availability timeline and interim security advisories. 7 days: Implement network segmentation to restrict VPN appliance administrative access to authorized networks only; enable detailed audit logging for all administrative authentication events on affected devices. 30 days: Prepare for firmware upgrade to patched version upon vendor release; evaluate alternative MFA methods (hardware tokens, push-based authentication) independent of TOTP; conduct VPN access audit to identify any high-privilege accounts requiring credential rotation.

Sonicwall CVE-2026-4116

EUVD-2026-20908 HIGH

Improper Handling of Unicode Encoding (CWE-176)

2026-04-09 sonicwall

GHSA-98v3-fwpf-r4w2

Authentication Bypass Sonicwall

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:29 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

7.2 (HIGH)

EUVD ID Assigned

Apr 09, 2026 - 15:00 euvd

EUVD-2026-20908

CVE Published

Apr 09, 2026 - 14:27 nvd

N/A

DescriptionCVE.org

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.

AnalysisAI

Two-factor authentication bypass in SonicWall SMA1000 SSL-VPN allows remote attackers with valid SSLVPN credentials to circumvent TOTP requirements via Unicode encoding manipulation. Affects SMA1000 versions 12.5.0-02283 and 12.4.3-03245 and earlier. Requires high-privilege (PR:H) authenticated access but enables complete authentication bypass (CVSS 7.2). Low EPSS score (0.03%, 10th percentile) indicates minimal observed exploitation likelihood. No public exploit code identified at time of analysis.

Technical ContextAI

The vulnerability stems from improper Unicode normalization or canonicalization (CWE-176) in the authentication flow of SonicWall SMA1000 series appliances. When users authenticate to Workplace or Connect Tunnel features requiring TOTP (Time-based One-Time Password) multi-factor authentication, the system fails to correctly process Unicode-encoded input. This character encoding flaw allows attackers to craft authentication requests with specially encoded Unicode characters that bypass the TOTP validation logic while still being accepted by other authentication components. SMA1000 appliances function as SSL-VPN gateways providing secure remote access, making authentication bypass vulnerabilities particularly critical to enterprise security posture. Unicode handling vulnerabilities typically exploit differences in how various system components normalize or compare strings containing non-ASCII characters, homoglyphs, or combining characters.

RemediationAI

Apply the vendor-released security updates immediately for affected SMA1000 appliances. SonicWall has published patches addressing this Unicode handling flaw, available through the official PSIRT advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0003. Organizations should upgrade to the latest platform-hotfix versions that supersede 12.5.0-02283 for the 12.5.x branch and 12.4.3-03245 for the 12.4.x branch. Until patching is complete, implement compensating controls including enhanced monitoring of SSLVPN authentication logs for anomalous Unicode characters in authentication requests, enforcement of principle of least privilege to minimize high-privilege SSLVPN accounts (reducing PR:H attack surface), and consideration of additional authentication factors beyond TOTP if supported by the platform. Review access logs for evidence of exploitation attempts involving unusual character encodings in authentication flows.