CVE-2026-111090: CWE-287: Improper Authentication in Stormshield Stormshield Network Security

This vulnerability (CVE-2026-111090) in Stormshield Network Security arises from a logic error in the signature verification process, which leads to acceptance of update and license files without proper authentication. This improper authentication (CWE-287) could allow an attacker to supply malicious or unauthorized updates or licenses. The affected versions are explicitly listed as >=4.3.0 <=4.3.44, >=4.8.0 <=4.8.19, >=5.0.0 <=5.0.9, and >=5.1.0 <=5.1.3. The vendor recommends using only MyStormshield servers for updates or automatic verification via SNS to ensure authenticity. The CVSS vector indicates the attack requires local access with low complexity, no privileges, and user interaction, but results in high impact to confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to bypass authentication controls on update and license files, potentially leading to unauthorized code execution, license manipulation, or denial of service. The impact is rated high for confidentiality, integrity, and availability according to the CVSS 3.1 score of 7.8.

No explicit patch or fix is indicated in the provided data. Users should strictly use update files and licenses obtained only from the official MyStormshield servers or ensure automatic verification via SNS is enabled to prevent acceptance of unauthenticated files. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.