CERT-FR: Stormshield Management Center before 3.9.4 affected by remote code execution flaw CVE-2026-111497
The French CERT-FR published advisory CERTFR-2026-AVI-1429 on 30 October 2026 about a vulnerability in Stormshield Management Center (SMC). The flaw allows an attacker to execute arbitrary code remotely. The advisory covers versions prior to 3.9.4 and refers to the vendor bulletin STORM-2026-034 of 30 October 2026. It does not mention exploitation in the wild and gives no CVSS score or technical details.
Entenda a falha
A vulnerabilidade
CVE-2026-111497 is a remote arbitrary code execution flaw in Stormshield Management Center (SMC), the vendor's central management product. Versions prior to 3.9.4 are affected, and 3.9.4 or later fixes it. CERT-FR advisory CERTFR-2026-AVI-1429 and the vendor bulletin STORM-2026-034 (30 October 2026) give no CVSS score, no affected component, and no details on prerequisites such as authentication, network reach or user interaction. The advisory does not mention exploitation in the wild.
Como funciona
The sources do not describe how the vulnerable process works. They say only that an attacker can cause remote arbitrary code execution on Stormshield Management Center. Which input reaches which component, and at which step it fails, is not public in the material available.
Por que é vulnerável
The root cause is not stated in the CERT-FR advisory, and the vendor bulletin's contents were not included in the material. It is therefore unknown whether the flaw is a missing check, unsafe parsing or another type of error. The fix is delivered in version 3.9.4, but what it changes is not described.
Como foi descoberta
The articles do not say who found the flaw or how. The CERT-FR advisory only states that a vulnerability was discovered in Stormshield Management Center, and it points to the vendor bulletin STORM-2026-034 published on 30 October 2026, the same day as the advisory. No exploitation in the wild is mentioned.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 12:24.
Detalhes técnicos
- Affected product: Stormshield Management Center versions prior to 3.9.4.
- Impact: remote arbitrary code execution.
- CVE referenced: CVE-2026-111497.
Remediação
- Apply the fixes described in the Stormshield security bulletin STORM-2026-034 (https://advisories.stormshield.eu/2026-034), which means updating to version 3.9.4 or later.
Linha do tempo
-
CERT-FR: Stormshield Management Center before 3.9.4 affected by remote code execution flaw CVE-2026-111497
ler a análise desta fonte ocultar
The French CERT-FR published advisory CERTFR-2026-AVI-1429 on 30 October 2026 about a vulnerability in Stormshield Management Center (SMC). The flaw allows an attacker to execute arbitrary code remotely. The advisory covers versions prior to 3.9.4 and refers to the vendor bulletin STORM-2026-034 of 30 October 2026. It does not mention exploitation in the wild and gives no CVSS score or technical details.
Technical Details
- Affected product: Stormshield Management Center versions prior to 3.9.4.
- Impact: remote arbitrary code execution.
- CVE referenced: CVE-2026-111497.
Remediation
- Apply the fixes described in the Stormshield security bulletin STORM-2026-034 (https://advisories.stormshield.eu/2026-034), which means updating to version 3.9.4 or later.