Improper Signature Verification of Active Update Files

Advisory ID	CVE Number	Date discovered	Severity	Advisory revision
STORM-2026-032		08/03/2026	medium	v1

Vulnerability details

A failure has been identified in the SNS during dynamic data files signature check.

Products	Severity	Detail
Stormshield Network Security	medium	SNS is impacted.

Version	Date	Description
v1	10/16/2026	Initial release

A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.

Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.
If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.

The following updates will fix this vulnerability:

Attack Vector	Attack Complexity	Privileges Required	User Interaction	Scope	Confidentiality Impact	Integrity Impact	Availability impact
Adjacent Network	High	None	None	Unchanged	High	High	High

CVSS Base score: 7.5	CVSS Vector: (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Exploit Code Maturity	Remediation Level	Report Confidence
Proof of concept code	Official fix	Confirmed

CVSS Temporal score: 6.7	CVSS Vector: (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)

Attack Vector (MAV)	Attack Complexity (MAC)	Privileges Required (MPR)	User Interaction (MUI)	Scope (MS)
Adjacent Network	High	None	None	Unchanged

Confidentiality Impact (MC)	Integrity Impact (MI)	Availability Impact (MA)
High	High	High

Confidentiality Requirement (CR)	Integrity Requirement (IR)	Availability Requirement (AR)
High	High	High

CVSS Environmental score: 6.7	CVSS Vector: (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C/CR:H/IR:H/AR:H/MAV:A/MAC:H/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H)