Stormshield Network Security: Improper signature verification of update files
Summary
Stormshield Network Security (SNS) firmware and license verification contains a logic error that accepts unauthenticated update and license files. The vendor's CVSS vector is local with user interaction, so an attacker would need to get a manipulated file installed, for example through a malicious file or a compromised update path. If that happens, the vendor rates the impact on confidentiality, integrity and availability as high. Retrieving files only from MyStormshield servers or enabling SNS automatic verification removes the risk according to the vendor.
Affected
- SNS 4.3.0 to 4.3.44
- SNS 4.8.0 to 4.8.19
- SNS 5.0.0 to 5.0.9
- SNS 5.1.0 to 5.1.3
Fixed in
- SNS 4.3.45 QS
- SNS 4.8.20 LTSB
- SNS 5.0.10
- SNS 5.1.4 EA
Workaround
- Verify the SHA-256 hash of each update file against the reference hashes in the MyStormshield portal.
- Retrieve update and license files only from MyStormshield servers.
- Enable automatic verification via SNS.
Exploitation
- The vendor lists exploit code maturity as Proof of concept code and the remediation level as Official fix.
- VulDB reports no available exploit.
- Zone Antimalware reports no active exploitation as of its writing.
- The vulnerability is not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no, Technical impact total.
- Whether a public PoC exists is unknown; assume one may exist.
Our recommendation
- Update SNS to the fixed version of your branch in the next maintenance window.
- Until patching, retrieve updates and licenses only from MyStormshield servers or enable SNS automatic verification.
- Verify the SHA-256 hash of every update file before installation.
- Restrict administrative access to firewalls and check admin workstations for compromise.
- Monitor firewall update and license changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Stormshield Advisory STORM-2026-031 advisories.stormshield.eu
- Stormshield Advisory STORM-2026-032 (related) advisories.stormshield.eu
- CERT-FR CERTFR-2026-AVI-1339 cert.cyber.gouv.fr
- ANSSI-linked notice (cyberveille) cyberveille.esante.gouv.fr
- VulDB CVE-2026-111090 vuldb.com
- OpenCVE CVE-2026-111090 app.opencve.io
- Zone Antimalware: Stormshield fix zoneantimalware.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:34.
Original description (NVD)
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.