---
id: CVE-2026-111090
title: Improper Signature Verification of Firmware Update Files
summary: >-
  A logic error exists in the signature verification routine resulting in
  acceptance of unauthenticated update and license files.It is necessary to use
  only the MyStormshield servers to retrieve update files or licenses, or to use
  automati…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-287
vendor: Stormshield
product: Stormshield Network Security
affected:
  - network_security >= 4.3.0 <= 4.3.44
  - network_security >= 4.8.0 <= 4.8.19
  - network_security >= 5.0.0 <= 5.0.9
  - network_security >= 5.1.0 <= 5.1.3
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T07:42:53.842Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111090'
references:
  - url: 'https://advisories.stormshield.eu/2026-031/'
tags:
  - cve.org
ingestedAt: '2026-10-20T07:55:43.636Z'
---

## Overview

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.

## Affected

- `network_security >= 4.3.0 <= 4.3.44`
- `network_security >= 4.8.0 <= 4.8.19`
- `network_security >= 5.0.0 <= 5.0.9`
- `network_security >= 5.1.0 <= 5.1.3`

## Remediation

The following updates will fix this vulnerability:





  *  

SNS 5.1.4 EA


  *  

SNS 5.0.10


  *  

SNS 4.8.20 LTSB

### Workarounds

If applicable, verify the SHA-256 hash of each update file. The reference hashes are available in the MyStormshield portal