CVE-2026-111090— Improper Signature Verification of Firmware Update Files
Quick assessment
Affected
Stormshield Stormshield Network Security
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
签名验证流程中存在逻辑错误，导致未经验证的更新文件和许可证文件被接受。因此，必须仅通过 MyStormshield 服务器获取更新文件或许可证，或使用 SNS 进行自动验证。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111090
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Signature Verification of Firmware Update Files
Source: CVE Program / CVE List V5
Vulnerability Description
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Stormshield | Stormshield Network Security | 4.3.0 ~ 4.3.44 | - |
|
II. Public POCs for CVE-2026-111090
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111090
请登录查看更多情报信息。
Other References for CVE-2026-111090 (1)
Same Patch Batch · Stormshield · 2026-10-20 · 3 CVEs total
| CVE-2026-113469 | 7.5 HIGH | Improper Signature Verification of Active Update Files |
| CVE-2026-113465 | 6.6 MEDIUM | Possible DOM XSS in SNS Web Administration Portal |
IV. Related Vulnerabilities
Same product: Stormshield Network Security
-
CVE-2026-113469
Improper Signature Verification of Active Update Files -
CVE-2026-113465
Possible DOM XSS in SNS Web Administration Portal -
CVE-2026-14466
Possible XSS in the SNS web administration panel -
CVE-2026-8482
Information leak in NSRPC client history -
CVE-2026-8480
Connection possible to the Administration portal with a revo
Same vendor: Stormshield
-
CVE-2026-113469
Improper Signature Verification of Active Update Files -
CVE-2026-113465
Possible DOM XSS in SNS Web Administration Portal -
CVE-2026-14466
Possible XSS in the SNS web administration panel -
CVE-2026-8482
Information leak in NSRPC client history -
CVE-2026-8480
Connection possible to the Administration portal with a revo
Same weakness: CWE-287
-
CVE-2026-113469
Improper Signature Verification of Active Update Files -
CVE-2026-107400
Security Vulnerability identified in IBM TRIRIGA - GWT Mock -
CVE-2026-105815
Credential Material Exposure Leading to Unauthorized Streame -
CVE-2026-105814
Order-Dependent Authentication Bypass in the DS JSON API in -
CVE-2026-112775
Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via us
V. Comments for CVE-2026-111090
No comments yet