CVE-2026-4114

MediumCVSS 6.6

Published: 09/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

48th percentile - higher than 48% of all known CVEs

Summary

SonicWall SMA1000 series appliances improperly handle Unicode encoding, allowing a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.

Risk Assessment

This could let an attacker with valid SSLVPN credentials access the AMC interface without the second factor, weakening security.

Recommendation

Update SonicWall SMA1000 firmware to a patched version and monitor for suspicious login attempts.

Other vulnerabilities in SonicWall SMA1000

CVE-2025-40602MediumActively exploited
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

Original NVD description (English source)

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS