CVE-2026-113469 - Vulnerability Details - OpenCVE

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Stormshield	Stormshield Network Security

No data.

No data.

References

Link	Providers
https://advisories.stormshield.eu/2026-032/

History

Tue, 20 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 20 Oct 2026 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Stormshield Stormshield stormshield Network Security
Vendors & Products		Stormshield Stormshield stormshield Network Security

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
Title		Improper Signature Verification of Active Update Files
Weaknesses		CWE-287
References		https://advisories.stormshield.eu/2026-032/
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: airbus

Published: 2026-10-20T08:29:49.095Z

Updated: 2026-10-20T18:08:00.762Z

Reserved: 2026-10-20T08:23:20.615Z

Link: CVE-2026-113469

Vulnrichment

Updated: 2026-10-20T18:07:40.402Z

NVD

Status : Deferred

Published: 2026-10-20T09:17:09.587

Modified: 2026-10-20T19:35:23.397

Link: CVE-2026-113469

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-113469", "assignerOrgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "state": "PUBLISHED", "assignerShortName": "airbus", "dateReserved": "2026-10-20T08:23:20.615Z", "datePublished": "2026-10-20T08:29:49.095Z", "dateUpdated": "2026-10-20T18:08:00.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "shortName": "airbus", "dateUpdated": "2026-10-20T08:29:49.095Z"}, "title": "Improper Signature Verification of Active Update Files", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "affected": [{"vendor": "Stormshield", "product": "Stormshield Network Security", "versions": [{"status": "affected", "version": "4.3.0", "lessThanOrEqual": "4.3.44", "versionType": "semver"}, {"status": "affected", "version": "4.8.0", "lessThanOrEqual": "4.8.19", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThanOrEqual": "5.0.9", "versionType": "semver"}, {"status": "affected", "version": "5.1.0", "lessThanOrEqual": "5.1.3", "versionType": "semver"}, {"status": "unaffected", "version": "4.8.20 LTSB", "versionType": "semver"}, {"status": "unaffected", "version": "5.0.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.1.4 EA"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A failure has been identified in the SNS during dynamic data files signature check.</p><p>A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.</p>"}]}], "references": [{"url": "https://advisories.stormshield.eu/2026-032/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "workarounds": [{"lang": "en", "value": "* Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.\n * If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<ul><li>Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.</li><li>If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.</li></ul>"}]}], "solutions": [{"lang": "en", "value": "The following updates will fix this vulnerability:\n\n * SNS 5.1.4 EA\n * SNS 5.0.10\n * SNS 4.8.20 LTSB", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The following updates will fix this vulnerability:</p><ul><li>SNS 5.1.4 EA</li><li>SNS 5.0.10</li><li>SNS 4.8.20 LTSB</li></ul>"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-113469", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-20T15:15:05.318940Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T18:08:00.762Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-113469", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-20T15:15:05.318940Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T18:07:40.402Z"}}], "cna": {"title": "Improper Signature Verification of Active Update Files", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Stormshield", "product": "Stormshield Network Security", "versions": [{"status": "affected", "version": "4.3.0", "versionType": "semver", "lessThanOrEqual": "4.3.44"}, {"status": "affected", "version": "4.8.0", "versionType": "semver", "lessThanOrEqual": "4.8.19"}, {"status": "affected", "version": "5.0.0", "versionType": "semver", "lessThanOrEqual": "5.0.9"}, {"status": "affected", "version": "5.1.0", "versionType": "semver", "lessThanOrEqual": "5.1.3"}, {"status": "unaffected", "version": "4.8.20 LTSB", "versionType": "semver"}, {"status": "unaffected", "version": "5.0.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.1.4 EA"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "The following updates will fix this vulnerability:\n\n * SNS 5.1.4 EA\n * SNS 5.0.10\n * SNS 4.8.20 LTSB", "supportingMedia": [{"type": "text/html", "value": "<p>The following updates will fix this vulnerability:</p><ul><li>SNS 5.1.4 EA</li><li>SNS 5.0.10</li><li>SNS 4.8.20 LTSB</li></ul>", "base64": false}]}], "references": [{"url": "https://advisories.stormshield.eu/2026-032/"}], "workarounds": [{"lang": "en", "value": "* Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.\n * If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.", "supportingMedia": [{"type": "text/html", "value": "<ul><li>Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.</li><li>If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.</li></ul>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.", "supportingMedia": [{"type": "text/html", "value": "<p>A failure has been identified in the SNS during dynamic data files signature check.</p><p>A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "shortName": "airbus", "dateUpdated": "2026-10-20T08:29:49.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-113469", "state": "PUBLISHED", "dateUpdated": "2026-10-20T18:08:00.762Z", "dateReserved": "2026-10-20T08:23:20.615Z", "assignerOrgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "datePublished": "2026-10-20T08:29:49.095Z", "assignerShortName": "airbus"}, "dataVersion": "5.2"}