Loading vulnerability…
CVE-2026-4112 is an SQL injection vulnerability in SonicWall Secure Mobile Access (SMA) 1000 series appliances. The flaw is described as improper neutralization of special elements used in an SQL command, allowing a remote authenticated attacker with read-only administrator privileges to inject SQL statements. Successful exploitation enables privilege escalation from a read-only administrative role to the primary administrator role on the affected appliance.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a README and a single Python PoC, sma_admin_hash_poc.py. The project is a real exploit, not merely documentation or detection logic. Its purpose is to exploit a post-authentication privilege-escalation chain against SonicWall SMA 8200v by abusing a cross-parameter blind SQL injection in the management console endpoint /activeUsers.action on port 8443. The exploit authenticates to the web console using /console.action and /j_security_check, then uses crafted realmFilter and communityFilter values to trigger time-based SQL conditions. It leverages MariaDB LOAD_FILE() to read /usr/local/app/mgmt-server/datastore/active/sysconf/avconfig.xml and extracts the administrator SHA-512 crypt hash character-by-character using timing thresholds and binary search. The script then formats the recovered hash for offline cracking and optionally runs hashcat, with the stated goal of recovering the shared admin/root credential. Structurally, the Python file includes constants for target URLs and timing, helper routines for SQL-safe literal construction, authentication/session handling, blind extraction logic, output formatting, and optional cracking orchestration. Overall, this is an operational authenticated web/network exploit for credential extraction leading to likely root compromise.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.