CVE-2026-4114
Undergoing Analysis Undergoing Analysis - In Progress
Authentication Bypass via Unicode Handling in SonicWall SMA

Publication date: 2026-04-09

Last updated on: 2026-05-10

Assigner: SonicWALL, Inc.

Description
Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-09
Last Modified
2026-05-10
Generated
2026-06-16
AI Q&A
2026-04-09
EPSS Evaluated
2026-06-14
NVD
CVE-2026-4114
EUVD
EUVD-2026-20906
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
sonicwall sma1000 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-176 The product does not properly handle when an input contains Unicode encoding.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of Unicode encoding in SonicWall SMA1000 series appliances. It allows a remote authenticated SSLVPN administrator to bypass AMC TOTP (Time-based One-Time Password) authentication.

Impact Analysis

An attacker who is a remote authenticated SSLVPN administrator can bypass the AMC TOTP authentication mechanism. This could potentially allow unauthorized access to systems or data that rely on this two-factor authentication for security.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4114. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart