Potential RCE in SMC Web Administration Portal

Advisory ID CVE Number Date discovered Severity Advisory revision
STORM-2026-034 CVE-2026-111497 10/23/2026 high v1

Vulnerability details

SMC is affected by Node2Shell, an out-of-bounds write in the Brotli decoder bundled with Node.js that can lead to remote code execution on the SMC server.

Impacted products

ProductsSeverityDetail
Stormshield Management Center high SMC is impacted

Revisions

Version Date Description
v1 10/30/2026 Initial release


Stormshield Management Center

CVSS v3.1 Overall Score: 7.9      

Analysis

Impacted version

An attacker able to send Brotli data to the SMC server can cause:

  • a denial of service (Node.js process crash);
  • under certain conditions, arbitrary code execution with the privileges of the SMC service.

The risk associated with this vulnerability is mitigated if the deployment recommendations for SMC, as describe in the installation guide and Recommendations on the operating environment, have been respected

For more information on Stormshield Management Center centralized administration, please refer to SMC installation guide and SMC administration guide.
  • SMC <= 3.9.3

Workaround solution

Solution

Until the update is applied:

  • restrict network access to the SMC administration interface to trusted admin workstations only;
  • do not expose SMC to the Internet;
  • if a reverse proxy or WAF sits in front of SMC, reject requests carrying Content-Encoding: br

The 3.9.4 update will fix this vulnerability.



Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability impact
Adjacent Network Low None None Unchanged High High High
CVSS Base score: 8.8 CVSS Vector: (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Exploit Code Maturity Remediation Level Report Confidence
Proof of concept code Official fix Confirmed
CVSS Temporal score: 7.9 CVSS Vector: (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
Attack Vector (MAV) Attack Complexity (MAC) Privileges Required (MPR) User Interaction (MUI) Scope (MS)
Adjacent Network Low None None Unchanged
Confidentiality Impact (MC) Integrity Impact (MI) Availability Impact (MA)
High High High
Confidentiality Requirement (CR) Integrity Requirement (IR) Availability Requirement (AR)
High High High
CVSS Environmental score: 7.9 CVSS Vector: (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C/CR:H/IR:H/AR:H/MAV:X/MAC:X/MPR:X/MUI:X/MS:X/MC:X/MI:X/MA:X)