CVE-2026-4112
Title: SQL Injection for Privilege Escalation
SQLi
Proof Of Concept
PoC Available for CVE-2026-4112
CWE Category
CWE-89
Published Date
Apr 09, 2026
Modified Date
May 14, 2026
Exploit Status
Available
Score
7.2
CVSS v
Exploit Probability (EPSS)
0.61%
Vulnerability Summary
CVE-2026-4112: Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.
Impacted Vendors
Reference Links
CVSS v3.1
Source Entity
134c704f-9b21-4f2e-91b3-4a467353bcc0
Severity
HIGH
7.2
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Associated Attack Patterns (CAPEC)
Total: PatternsNo specific attack patterns mapped.
Likelihood
Severity
Page /
CVE-2026-4112 Exploits & PoCs (Proof Of Concept)
GitHub
https://github.com/Hann1bl3L3ct3r/CVE-2026-4112
MODIFIED
Vulnerability data updated via NVD.
MODIFIED
Vulnerability data updated via NVD.
MODIFIED
Vulnerability data updated via NVD.
MODIFIED
Vulnerability data updated via NVD.
MODIFIED
Vulnerability data updated via NVD.
MODIFIED
Vulnerability data updated via NVD.
Attack Vector Matrix
Access Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
CVSS Vector String
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Stack
No specific products linked.