Authentication Bypass Vulnerability in Stormshield Network Security Products
CVE-2026-8480

4.3MEDIUM

Key Information:

Vendor

Stormshield

Status
Stormshield Network Security
Vendor
CVE Published:
1 July 2026

What is CVE-2026-8480?

A security flaw exists in Stormshield Network Security products where revoked client certificates can still authorize access to the captive-admin portal. This vulnerability poses a risk as an attacker holding a revoked certificate may gain unauthorized administrative privileges, compromising the integrity and security of network management. Users are advised to review their certificate management policies and ensure timely updates to mitigate this risk.

Affected Version(s)

Stormshield Network Security 4.3.0 <= 4.3.41

Stormshield Network Security 4.4.0 <= 4.8.15

Stormshield Network Security 5.0.2 EA <= 5.0.5

References

https://advisories.stormshield.eu/2026-002/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.