Live › vulnerability › CVE-2026-111090
Go to dashboardA logic error in Stormshield SNS signature verification accepts unauthenticated firmware update and license files. An attacker must get an admin to install a tampered file. Vendor rates it medium (CVSS 7.8, local, user interaction required).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organisations running Stormshield appliances that fetch update or license files from sources other than MyStormshield servers, or that do not use automatic verification via SNS, are the ones the advisory points to. The sources do not name affected versions. Teams that only retrieve updates from MyStormshield with SNS verification enabled are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Stormshield Network Security | vendor | 4.3.0-4.3.44, 4.8.0-4.8.19, 5.0.0-5.0.9, 5.1.0-5.1.3 | 4.3.45 QS, 4.8.20 LTSB, 5.0.10, 5.1.4 EA |
5.1.0-5.1.3, 5.0.0-5.0.9, 4.8.0-4.8.19 or 4.3.0-4.3.445.1.4 EA, 5.0.10, 4.8.20 LTSB or 4.3.45 QSEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
This page as .md · .json · in your agent: get_signal("CVE-2026-111090")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.