{"id":"CVE-2026-111090","kind":"vulnerability","aliases":["CVE-2026-111090"],"related":[],"title":"Stormshield firewall accepts unsigned update and license files","description":"A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.","summary":"A logic error in Stormshield SNS signature verification accepts unauthenticated firmware update and license files. An attacker must get an admin to install a tampered file. Vendor rates it medium (CVSS 7.8, local, user interaction required).","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Stormshield Network Security","fixed":["4.3.45 QS","4.8.20 LTSB","5.0.10","5.1.4 EA"],"affected":"4.3.0-4.3.44, 4.8.0-4.8.19, 5.0.0-5.0.9, 5.1.0-5.1.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["appliance","firewall","infrastructure","license","self-hosted","sns","stormshield"],"not_affected_if":["managed-hosting","mystormshield-only-downloads","patched-version","sha256-verified"],"how_to_check":"Check the SNS firmware version (web admin dashboard or System > Maintenance). Exposed if running 5.1.0-5.1.3, 5.0.0-5.0.9, 4.8.0-4.8.19 or 4.3.0-4.3.44. Then check where your team gets update and license files: anything not from MyStormshield or SNS automatic verification is a risk.","fix":"Upgrade to SNS 5.1.4 EA, 5.0.10, 4.8.20 LTSB or 4.3.45 QS. Until then, fetch update and license files only from MyStormshield servers (or automatic verification via SNS) and verify each file's SHA-256 against the reference hash in the MyStormshield portal.","status":"open","published_at":"2026-10-20T08:16:42+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:10:08+00:00","updated_at":"2026-10-25T03:38:08+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-25T03:10:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Stormshield firewall accepts unsigned update and license files","impact":"high","summary":"A logic error in the signature check of Stormshield's update and license handling lets unauthenticated update and license files be accepted. An attacker who can supply those files can push a malicious update or license to the appliance.","category":"infrastructure","nicknames":[],"who_cares":["stormshield","firewall","appliance","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker installs a malicious update or license on the appliance","analyst_note":"Find the affected Stormshield product versions and fixed releases in the NVD entry or the vendor advisory, and confirm how update files are delivered.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Organisations running Stormshield appliances that fetch update or license files from sources other than MyStormshield servers, or that do not use automatic verification via SNS, are the ones the advisory points to. The sources do not name affected versions. Teams that only retrieve updates from MyStormshield with SNS verification enabled are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00055,"input_tokens":3287,"output_tokens":442,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Stormshield product versions and fixed releases in the NVD entry or the vendor advisory, and confirm how update files are delivered.","search":"'-111090':11A,14A '-2026':10A,13A '7.8':58B 'accept':3A,35B,74C 'admin':47B 'applianc':18B 'attack':43B 'automat':98C 'cve':9A,12A 'cvss':57B 'error':29B,65C 'exist':66C 'file':8A,41B,52B,92C 'files.it':80C 'firewal':2A,19B 'firmwar':37B 'get':45B 'host':24B 'infrastructur':20B 'instal':49B 'interact':61B 'licens':7A,21B,40B,79C,94C 'local':59B 'logic':28B,64C 'medium':56B 'must':44B 'mystormshield':87C 'necessari':82C 'network':16A 'rate':54B 'requir':62B 'result':72C 'retriev':90C 'routin':71C 'security':17A 'self':23B 'self-host':22B 'server':88C 'signatur':33B,69C 'sns':25B,32B,101C 'stormshield':1A,15A,26B,31B 'tamper':51B 'unauthent':36B,76C 'unsign':4A 'updat':5A,38B,77C,91C 'use':84C,97C 'user':60B 'vendor':53B 'verif':34B,70C,99C 'via':100C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Stormshield appliances that fetch update or license files from sources other than MyStormshield servers, or that do not use automatic verification via SNS, are the ones the advisory points to. The sources do not name affected versions. Teams that only retrieve updates from MyStormshield with SNS verification enabled are less exposed.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:38:08Z","by":"analyst","run_id":759},"products":{"at":"2026-10-25T03:38:08Z","by":"analyst","run_id":759},"workarounds":{"at":"2026-10-25T03:38:08Z","by":"analyst","run_id":759},"how_to_check":{"at":"2026-10-25T03:38:08Z","by":"analyst","run_id":759},"who_affected":{"at":"2026-10-25T03:38:08Z","by":"analyst","run_id":759}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T08:16:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cert@airbus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111090","severity":null,"published_at":"2026-10-20T08:16:42+00:00","modified_at":"2026-10-20T19:35:23+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111090:759","url":null,"severity":null,"published_at":"2026-10-25T03:38:08+00:00","modified_at":"2026-10-25T03:38:08+00:00","first_seen_at":"2026-10-25T03:38:08+00:00","fetched_at":"2026-10-25T03:38:08+00:00","note":"Read Stormshield STORM-2026-031 v2 (primary). Affected/fixed versions and workaround from vendor text. Vendor: medium, CVSS 7.8 local/user-interaction (admin installs a file). Temporal marks PoC maturity but no public PoC link found; no exploitation reported. Sibling CVE-2026-113469 (STORM-2026-032) is the autoupdate variant. Social not searched."}],"documents":[{"id":3259,"url":"https://advisories.stormshield.eu/2026-031/","title":"Stormshield STORM-2026-031: Improper Signature Verification of Firmware Update Files","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3260,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111090","title":"NVD CVE-2026-111090","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}