Security Flaw in MyStormshield Servers Affects Software Updates
CVE-2026-111090

7.8HIGH

Key Information:

Vendor

Stormshield

Status
Stormshield Network Security
Vendor
CVE Published:
20 October 2026

What is CVE-2026-111090?

A logic error exists in the signature verification routine of MyStormshield, which allows the system to accept unauthenticated update and license files. This vulnerability highlights the importance of retrieving updates exclusively from MyStormshield servers or ensuring automatic verification through SNS to safeguard against potential exploits.

Affected Version(s)

Stormshield Network Security 4.3.0 <= 4.3.44

Stormshield Network Security 4.8.0 <= 4.8.19

Stormshield Network Security 5.0.0 <= 5.0.9

References

https://advisories.stormshield.eu/2026-031/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.