CVE-2026-8482: CWE-532 Insertion of sensitive information into log file in Stormshield Stormshield Network Security
CVE-2026-8482 is a medium severity vulnerability in Stormshield Network Security versions 4.3.0 through 4.3.41, 4.8.0 through 4.8.15, and 5.0.0 through 5.0.5. It involves the insertion of sensitive information into log files when administration commands are executed via the CLI tool. An attacker with SSH access to the firewall, if SSH multiuser mode is enabled, could potentially retrieve sensitive credentials such as the proxy CA passphrase or TPM password from these logs.
AI Analysis
Technical Summary
This vulnerability (CWE-532) affects Stormshield Network Security appliances in specified versions. When administrative commands are run through the CLI, sensitive secrets like the proxy CA passphrase or TPM password may be logged insecurely. An attacker with SSH access and multiuser mode enabled could exploit this to obtain these secrets by reading the log files. The CVSS 3.1 base score is 4.3 (medium), reflecting the requirement for high privileges and user interaction, but with high confidentiality impact and no integrity or availability impact. No official remediation or patch has been published as of the data provided.
Potential Impact
If exploited, this vulnerability could lead to the disclosure of highly sensitive credentials (proxy CA passphrase, TPM password) to an attacker with SSH access and multiuser mode enabled. This compromises confidentiality but does not affect integrity or availability. The attacker must already have elevated privileges (high) and user interaction is required, limiting the ease of exploitation.
Mitigation Recommendations
No official patch or remediation level has been published yet. Administrators should review SSH multiuser mode settings and consider disabling it if not required to reduce exposure. Monitor access to log files and restrict SSH access to trusted users only. Check the vendor advisory regularly for updates on patches or official fixes.
CVE-2026-8482: CWE-532 Insertion of sensitive information into log file in Stormshield Stormshield Network Security
Description
CVE-2026-8482 is a medium severity vulnerability in Stormshield Network Security versions 4.3.0 through 4.3.41, 4.8.0 through 4.8.15, and 5.0.0 through 5.0.5. It involves the insertion of sensitive information into log files when administration commands are executed via the CLI tool. An attacker with SSH access to the firewall, if SSH multiuser mode is enabled, could potentially retrieve sensitive credentials such as the proxy CA passphrase or TPM password from these logs.
CVSS v3.1
Score 4.3medium
Affected software
pkg:github/stormshield/stormshield-network-securityRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-532) affects Stormshield Network Security appliances in specified versions. When administrative commands are run through the CLI, sensitive secrets like the proxy CA passphrase or TPM password may be logged insecurely. An attacker with SSH access and multiuser mode enabled could exploit this to obtain these secrets by reading the log files. The CVSS 3.1 base score is 4.3 (medium), reflecting the requirement for high privileges and user interaction, but with high confidentiality impact and no integrity or availability impact. No official remediation or patch has been published as of the data provided.
Potential Impact
If exploited, this vulnerability could lead to the disclosure of highly sensitive credentials (proxy CA passphrase, TPM password) to an attacker with SSH access and multiuser mode enabled. This compromises confidentiality but does not affect integrity or availability. The attacker must already have elevated privileges (high) and user interaction is required, limiting the ease of exploitation.
Mitigation Recommendations
No official patch or remediation level has been published yet. Administrators should review SSH multiuser mode settings and consider disabling it if not required to reduce exposure. Monitor access to log files and restrict SSH access to trusted users only. Check the vendor advisory regularly for updates on patches or official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- airbus
- Date Reserved
- 2026-05-13T14:04:22.661Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4634ad27e9c79719a6e416
Added to database: 07/02/2026, 09:51:41 UTC
Last enriched: 07/02/2026, 10:07:02 UTC
Last updated: 07/02/2026, 10:13:07 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.