# CVE-2026-4116: SonicWall SMA1000 series TOTP authentication bypass via Unicode encoding

Source: https://junglewise.ai/threats/cve-2026-4116-sonicwall-sma1000-series-totp-authentication-bypass-via-unicode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-4116 · Severity: high · CVSS 7.2 · Published 2026-04-09

SonicWall SMA1000 series appliances are secure access gateways used to provide remote employees with encrypted connections to corporate resources. A vulnerability in how these devices handle specific text characters allows an already authenticated user to bypass secondary security checks (TOTP/Two-Factor Authentication). This could allow a user with compromised credentials to gain deeper access to the network without providing the required one-time security code.

Vendors: [SonicWall](https://junglewise.ai/threats/vendors/sonicwall).

## Quick answers

**Is CVE-2026-4116 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4116 being exploited in the wild.

**How severe is CVE-2026-4116?** High severity, with a CVSS score of 7.2, published 9 April 2026.

**Which products and versions are affected?** SonicWall Sma 6200 Firmware < 12.4.3-03387, 12.5.0 < 12.5.0-02624; SonicWall Sma 6210 Firmware < 12.4.3-03387, 12.5.0 < 12.5.0-02624; SonicWall Sma 7200 Firmware < 12.4.3-03387, 12.5.0 < 12.5.0-02624; SonicWall Sma 7210 Firmware < 12.4.3-03387, 12.5.0 < 12.5.0-02624; and 1 more.

**Is there a fix for CVE-2026-4116?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4116 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-4116?** Check whether you run SonicWall Sma 6200 Firmware, SonicWall Sma 6210 Firmware, SonicWall Sma 7200 Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as improper handling of Unicode encoding (CWE-176) within the SonicWall SMA1000 series firmware. It resides in the authentication processing logic for Workplace and Connect Tunnel components. A remote attacker who has already successfully completed the primary authentication phase can exploit this flaw to bypass the Time-based One-Time Password (TOTP) requirement. This bypass is achieved by supplying specially crafted Unicode strings that the appliance fails to process correctly during the multi-factor authentication (MFA) handshake. Patches have been released in firmware versions 12.4.3-03387 and 12.5.0-02624.

## Affected products

- SonicWall SMA 6200 firmware < 12.4.3-03387, 12.5.0 < 12.5.0-02624
- SonicWall SMA 6210 firmware < 12.4.3-03387, 12.5.0 < 12.5.0-02624
- SonicWall SMA 7200 firmware < 12.4.3-03387, 12.5.0 < 12.5.0-02624
- SonicWall SMA 7210 firmware < 12.4.3-03387, 12.5.0 < 12.5.0-02624
- SonicWall SMA 8200v firmware < 12.4.3-03387, 12.5.0 < 12.5.0-02624

## Timeline

- 2026-04-09: disclosed
- 2026-04-09: advisory: SonicWall PSIRT published SNWLID-2026-0003

## References

- [https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0003](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0003)