/
← Voltar ao feed
high

CERT-FR flags multiple Stormshield Network Security and Management Center vulnerabilities, including arbitrary code execution

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 1 dia

CERT-FR has published advisory CERTFR-2026-AVI-1345 on multiple vulnerabilities in Stormshield products. According to the advisory, some flaws allow an attacker to achieve arbitrary code execution, remote denial of service and breaches of data confidentiality. Others allow security policy bypass and indirect remote code injection (XSS). The advisory relies on Stormshield bulletins STORM-2026-023 to STORM-2026-029, published on 16 and 20 October 2026. It does not mention active exploitation, IOCs or attribution.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1345 covers 19 CVEs in Stormshield Network Security (SNS) and Stormshield Management Center. The advisory says some flaws allow arbitrary code execution, remote denial of service and loss of data confidentiality, while others allow security policy bypass and indirect remote code injection (XSS). It does not map impacts to individual CVEs, give CVSS scores, or state the attacker's requirements (network reach, authentication, configuration). Affected: Management Center 3.9.x before 3.9.3; SNS 4.3.x before 4.3.45 QS, 4.8.x before 4.8.20 LTSB, 5.0.x before 5.0.10 and 5.1.x before 5.1.4 EA. Those are the fixed versions as the advisory presents them.

Como funciona

The articles do not describe how any of these flaws work. The CERT-FR advisory only lists the impact categories and the affected versions, and leaves the mechanism of each CVE to the vendor bulletins STORM-2026-023 to STORM-2026-029. It is therefore not possible to say which input reaches which component, or at which step it fails, for any of the 19 CVEs.

Por que é vulnerável

The root causes are not given in the available articles. The advisory names only impact classes (code execution, denial of service, confidentiality breach, policy bypass, XSS) and does not explain why the products were vulnerable, why the flaws went unnoticed, or what the fixes change beyond moving to the patched versions.

Como foi descoberta

The articles do not say who found the flaws or how. The CERT-FR advisory, published on 21 October 2026, relies on Stormshield bulletins STORM-2026-026 to STORM-2026-029 dated 16 October 2026 and STORM-2026-023 to STORM-2026-025 dated 20 October 2026. The advisory does not mention active exploitation, IOCs or attribution.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 13:27.

Detalhes técnicos

  • Affected: Stormshield Management Center 3.9.x before 3.9.3.
  • Stormshield Network Security 4.3.x before 4.3.45 QS, 4.8.x before 4.8.20 LTSB, 5.0.x before 5.0.10 and 5.1.x before 5.1.4 EA.
  • The advisory lists 19 CVEs: CVE-2026-113808, CVE-2026-113810, CVE-2026-14666, CVE-2026-15741, CVE-2026-18408, CVE-2026-34181, CVE-2026-42768, CVE-2026-45447, CVE-2026-48931, CVE-2026-56850, CVE-2026-58040, CVE-2026-58045, CVE-2026-78123, CVE-2026-78124, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78135 and CVE-2026-84732.
  • It gives no CVSS scores and does not map impact to individual CVEs.

Remediação

  • Consult the Stormshield security bulletins STORM-2026-023 to STORM-2026-029 and upgrade to the fixed versions they list.
  • Prioritise internet-exposed Stormshield Network Security firewalls and Management Center instances.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 22/10 13:01 primeiro registro

    CERT-FR flags multiple Stormshield Network Security and Management Center vulnerabilities, including arbitrary code execution

    ler a análise desta fonte

    CERT-FR has published advisory CERTFR-2026-AVI-1345 on multiple vulnerabilities in Stormshield products. According to the advisory, some flaws allow an attacker to achieve arbitrary code execution, remote denial of service and breaches of data confidentiality. Others allow security policy bypass and indirect remote code injection (XSS). The advisory relies on Stormshield bulletins STORM-2026-023 to STORM-2026-029, published on 16 and 20 October 2026. It does not mention active exploitation, IOCs or attribution.

    Technical Details

    • Affected: Stormshield Management Center 3.9.x before 3.9.3.
    • Stormshield Network Security 4.3.x before 4.3.45 QS, 4.8.x before 4.8.20 LTSB, 5.0.x before 5.0.10 and 5.1.x before 5.1.4 EA.
    • The advisory lists 19 CVEs: CVE-2026-113808, CVE-2026-113810, CVE-2026-14666, CVE-2026-15741, CVE-2026-18408, CVE-2026-34181, CVE-2026-42768, CVE-2026-45447, CVE-2026-48931, CVE-2026-56850, CVE-2026-58040, CVE-2026-58045, CVE-2026-78123, CVE-2026-78124, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78135 and CVE-2026-84732.
    • It gives no CVSS scores and does not map impact to individual CVEs.

    Remediation

    • Consult the Stormshield security bulletins STORM-2026-023 to STORM-2026-029 and upgrade to the fixed versions they list.
    • Prioritise internet-exposed Stormshield Network Security firewalls and Management Center instances.