{"id":"CVE-2026-113469","title":"Improper Signature Verification of Active Update Files","summary":"A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-287"],"vendor":"Stormshield","product":"Stormshield Network Security","affected":["network_security >= 4.3.0 <= 4.3.44","network_security >= 4.8.0 <= 4.8.19","network_security >= 5.0.0 <= 5.0.9","network_security >= 5.1.0 <= 5.1.3"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T08:29:49.095Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113469","references":[{"url":"https://advisories.stormshield.eu/2026-032/"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T12:05:07.355Z","slug":"CVE-2026-113469","body":"## Overview\n\nA failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.\n\n## Affected\n\n- `network_security >= 4.3.0 <= 4.3.44`\n- `network_security >= 4.8.0 <= 4.8.19`\n- `network_security >= 5.0.0 <= 5.0.9`\n- `network_security >= 5.1.0 <= 5.1.3`\n\n## Remediation\n\nThe following updates will fix this vulnerability:\n\n  *  SNS 5.1.4 EA\n  *  SNS 5.0.10\n  *  SNS 4.8.20 LTSB\n\n### Workarounds\n\n*  Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.\n  *  If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}