CVE-2026-111090
7.8HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-287
Impact
Attackers can achieve full local system compromise by tricking an administrator into applying unauthenticated update or license files. Exploitation requires local access and user interaction to load the malicious file.
Root cause
A logic error in the signature verification routine allows unauthenticated update and license files to pass validation.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Check advisory 2026-031 for fixed firmware versions. In the interim, ensure all updates and licenses are retrieved strictly from MyStormshield servers or configure automatic verification via SNS.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.