CVE-2026-113469
7.5HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-287
Impact
Adjacent attackers can push forged dynamic data updates to the appliance without credentials. This can lead to system compromise or altered security policies during Autoupdate routines.
Root cause
A logic error in the signature verification routine allows unauthenticated dynamic data files to pass validation.
Affected systems
Stormshield Network Security (SNS); exact version ranges not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the patch referenced in Stormshield advisory 2026-032. If patching immediately is not possible, disable the dynamic data Autoupdate routine.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.