CVE-2026-8480 is an improper certificate validation vulnerability in Stormshield Network Security that affects multiple versions from 4.3.0 up to 5.0.5 inclusive. The issue allows revoked client certificates to bypass revocation checks and authenticate successfully to the captive-admin portal. This flaw enables an attacker who has a revoked certificate to gain administrative access to the system, potentially compromising administrative controls. The vulnerability is identified as CWE-295 and has a CVSS 3.1 base score of 4.3, reflecting a medium impact primarily on confidentiality.

An attacker in possession of a revoked client certificate can still authenticate to the captive-admin portal, thereby gaining unauthorized administrative access. This could lead to unauthorized administrative actions or configuration changes. The CVSS vector indicates the attack requires adjacent network access, no privileges, and no user interaction, with limited confidentiality impact and no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented in the provided data. Until a patch is available, restrict access to the captive-admin portal to trusted networks and monitor for unauthorized administrative access attempts.