/
← Voltar ao feed
medium

CERT-FR: Multiple vulnerabilities in Stormshield Network Security allow XSS, security policy bypass and data integrity compromise

1 fonte(s) · 1 atualização(ões) · publicado 18/10/2026 21:00 · coletado há 1 dia

CERT-FR advisory CERTFR-2026-AVI-1339 reports multiple vulnerabilities in Stormshield Network Security (SNS). Depending on the flaw, an attacker could compromise data integrity, bypass the security policy or inject indirect remote code through cross-site scripting (XSS). The advisory refers to four Stormshield security bulletins dated 16 October 2026 (STORM-2026-022, -030, -031 and -032) and cites CVE-2026-111090. It does not state active exploitation, technical root causes, IOCs or attribution.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1339 reports multiple vulnerabilities in Stormshield Network Security (SNS) and cites CVE-2026-111090. Depending on the flaw, an attacker could compromise data integrity, bypass the security policy or achieve indirect remote code injection through XSS. The vendor did not specify any further impact. The advisory gives no attack vector, authentication or configuration requirements, and no CVSS scores. Affected: 5.0.x before 5.0.10, 5.1.x before 5.1.4 EA, and versions before 4.8.20 LTSB. Fixed in 5.0.10, 5.1.4 EA and 4.8.20 LTSB or later.

Como foi descoberta

The articles do not say who found the flaws or how. Stormshield published four security bulletins on 16 October 2026 (STORM-2026-022, -030, -031 and -032), and CERT-FR issued its advisory on 19 October 2026 pointing to them for the patches. The advisory does not mention active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 13:19.

Detalhes técnicos

  • Affected: Stormshield Network Security 5.0.x before 5.0.10, 5.1.x before 5.1.4 EA, and versions before 4.8.20 LTSB.
  • Impact: data integrity compromise, security policy bypass and indirect remote code injection (XSS). The vendor did not specify a further impact.
  • The advisory gives no attack vector or CVSS scores.

Remediação

  • Consult the Stormshield security bulletins (STORM-2026-022, -030, -031, -032) to obtain the patches.
  • Upgrade to SNS 5.0.10, 5.1.4 EA or 4.8.20 LTSB, or later, depending on the branch in use.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 18/10/2026 21:00 · coletado 22/10 13:01 primeiro registro

    CERT-FR: Multiple vulnerabilities in Stormshield Network Security allow XSS, security policy bypass and data integrity compromise

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1339 reports multiple vulnerabilities in Stormshield Network Security (SNS). Depending on the flaw, an attacker could compromise data integrity, bypass the security policy or inject indirect remote code through cross-site scripting (XSS). The advisory refers to four Stormshield security bulletins dated 16 October 2026 (STORM-2026-022, -030, -031 and -032) and cites CVE-2026-111090. It does not state active exploitation, technical root causes, IOCs or attribution.

    Technical Details

    • Affected: Stormshield Network Security 5.0.x before 5.0.10, 5.1.x before 5.1.4 EA, and versions before 4.8.20 LTSB.
    • Impact: data integrity compromise, security policy bypass and indirect remote code injection (XSS). The vendor did not specify a further impact.
    • The advisory gives no attack vector or CVSS scores.

    Remediation

    • Consult the Stormshield security bulletins (STORM-2026-022, -030, -031, -032) to obtain the patches.
    • Upgrade to SNS 5.0.10, 5.1.4 EA or 4.8.20 LTSB, or later, depending on the branch in use.