CVE-2026-4116
High · 7.2CVSS
7.2
EPSS
0.7%
Published
Apr 9, 2026
CISA due date
—
The record
Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by… CWE-176
- CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars()… CWE-176
- CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-176
- CVE-2026-14978 HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass… CWE-176
- CVE-2026-59890 setuptools is a package that allows users to download, build, install, upgrade, and… CWE-176
- CVE-2026-48618 A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling… CWE-176
- CVE-2026-49401 Deno is a JavaScript, TypeScript, and WebAssembly runtime. CWE-176
- CVE-2026-45135 Caddy is an extensible server platform that uses TLS by default. CWE-176