Stormshield SNS: Revoked Certificate Still Grants Access to Admin Portal

Vulnerability Overview Vulnerability Name: Connection possible to the administration portal with revoked certificate CVE ID: STORM-2026-002 Discovery Date: 11/05/2025 Severity: Low Vulnerability Description: Legitimate users can successfully connect to the management portal via certificate, even if the certificate has been revoked. Impact Scope Affected Product: Stormshield Network Security Affected Versions: - SNS 5.0.2 EA to 5.0.5 - SNS 4.4.0 to 4.8.15 - SNS 4.3.0 to 4.3.41 Remediation Plan Temporary Workaround: Run the "restart ssl" command after the certificate is revoked, or disable certificate-based authentication. Official Solution: Update to one of the following versions: - SNS 5.0.6 - SNS 4.8.16 - SNS 4.3.42 CVSS Score CVSS v3.1 Overall Score: 3.9 CVSS Base Score: 4.3 CVSS Temporal Score: 3.9 CVSS Environmental Score: 3.9 Additional Information Attack Vector: Adjacent Network Attack Complexity: Low Required Privileges: None User Interaction: None Scope: Unchanged Confidentiality Impact: Low Integrity Impact: None Availability Impact: None Report Confidence Proof of Concept Code: Confirmed Remediation Level: Official fix CVSS Vector CVSS Vector: [AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N] CVSS Vector: [AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C] CVSS Vector: [AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C/CR:M/IR:M/AR:M/MAV:X/MAC:X/MPR:X/MUI:X/MS:X/MC:X/M:I:X/MA:X] Version History v1: 02/19/2026 - Initial release v2: 05/21/2026 - Published as disclosed Page Footer Links RSS Feed Contact Report a vulnerability Legal terms Personal Data STORMSHIELD Corporate website The above is a summary of the key information regarding the vulnerability from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

Stormshield SNS: Revoked Certificate Still Grants Access to Admin Portal