Vulnerabilities

TI-2026-76997 CVE-2026-111088 · GHSA-3p55-3gfg-2x98

Stored cross-site scripting in Stormshield Network Security VPN logs

LOW 28

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00219 Published 2026-10-20 Fixed in 4.3.45 QS, 4.8.20 LTSB +2 CWE-79

TI-2026-77008 CVE-2026-113810 · GHSA-5pf7-8c56-xhx6

Stored XSS in Stormshield Network Security enrollment portal

LOW 32

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.

CVSS 3.1HIGH 7.0 Local No auth User interaction EPSS 0.00099 Published 2026-10-20 Fixed in 4.8.20 LTSB, 5.0.10 +1 CWE-79

TI-2026-77007 CVE-2026-113808 · GHSA-wrgg-3rf4-mcjj

Stored cross-site scripting in Stormshield SNS enrollment portal

LOW 33

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.

CVSS 3.1HIGH 7.1 Adjacent network No auth User interaction EPSS 0.00214 Published 2026-10-20 Fixed in 4.3.45 QS, 4.8.20 LTSB +2 CWE-79

TI-2026-76756 CVE-2026-113469 · GHSA-4382-r6qg-2rwv

Stormshield Network Security accepts unsigned dynamic data updates

LOW 34

A failure has been identified in the SNS during dynamic data files signature check.

CVSS 3.1HIGH 7.5 Adjacent network No auth No interaction EPSS 0.00196 Published 2026-10-20 Fixed in 4.8.20 LTSB, 5.0.10 +1 CWE-287

TI-2026-76755 CVE-2026-113465 · GHSA-hfqr-g88q-6m8g

DOM-based XSS in Stormshield web administration portal

LOW 29

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel.

CVSS 3.1MEDIUM 6.6 Adjacent network No auth User interaction EPSS 0.00226 Published 2026-10-20 Fixed in 5.0.10, 5.1.4 EA CWE-79

TI-2026-76746 CVE-2026-111090 · GHSA-cg8h-hvwf-mx5f

Stormshield Network Security accepts unauthenticated update files

LOW 35

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, o…

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00165 Published 2026-10-20 Fixed in 4.8.20 LTSB, 5.0.10 +2 CWE-287

TI-2026-12225 CVE-2026-14466 · GHSA-w9vr-4cw4-q9wq

Possible XSS in the SNS web administration panel

LOW 20

It’s possible to run a stored XSS in Stormshield’s web administration panel.

CVSS 3.1MEDIUM 4.3 Adjacent network High privileges User interaction EPSS 0.00235 Published 2026-09-04 Fixed in 4.8.17, 5.0.7 +1 CWE-79

TI-2026-07448 CVE-2026-8482 · GHSA-wcc8-vcvw-p9m3

Information leak in NSRPC client history

LOW 19

A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included) There is a possible leak of secret information if administration commands…

CVSS 3.1MEDIUM 4.3 Adjacent network High privileges User interaction EPSS 0.00228 Published 2026-07-02 No fix listed CWE-532

TI-2026-07446 CVE-2026-8480 · GHSA-2j5q-9jw8-9qj5

Connection possible to the Administration portal with a revoked certificate

LOW 19

A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included) A revoked client certificate can still be used to authenticate to the c…

CVSS 3.1MEDIUM 4.3 Adjacent network No auth No interaction EPSS 0.00126 Published 2026-07-01 No fix listed CWE-295

TI-2026-07441 CVE-2026-8474 · GHSA-72g9-78vw-8w8h

Possible to run a Cross Site Scripting request on the login API available on Stormshield SNS appliances.

LOW 23

A vulnerability was discovered on Stormshield Network Security * 4.3.0 to 4.3.41, * 4.8.0 to 4.8.15, * 5.0.0 to 5.0.5 It is possible to execute a reflected XSS attack on the login API available on Stormshield SNS applian…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00183 Published 2026-06-01 No fix listed CWE-79

TI-2025-30939 CVE-2025-48707 · GHSA-73cv-g86j-hx5c

An issue was discovered in Stormshield Network Security (SNS) before 5.0.1.

LOW 33

An issue was discovered in Stormshield Network Security (SNS) before 5.0.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00344 Published 2025-09-25 No fix listed CWE-284

TI-2023-13136 CVE-2023-28616 · GHSA-c4f2-4cmw-rccv

An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x…

LOW 33

An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00295 Published 2023-12-26 No fix listed CWE-319

TI-2023-25434 CVE-2023-47091 · GHSA-ch6f-2w93-3p64

An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22…

LOW 39

An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00531 Published 2023-12-25 No fix listed CWE-120

TI-2023-21774 CVE-2023-41165 · GHSA-vwgp-x2rf-chq4

An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before…

LOW 22

An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00412 Published 2023-12-25 No fix listed CWE-79

TI-2023-17040 CVE-2023-34198 · GHSA-93vc-xxjx-g2p3

In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through…

LOW 33

In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00513 Published 2023-12-25 No fix listed

TI-2023-25435 CVE-2023-47093 · GHSA-rq8j-xvfw-j2rc

An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0…

LOW 29

An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00287 Published 2023-12-20 No fix listed

TI-2023-21775 CVE-2023-41166 · GHSA-2wm9-x92q-p7jg

An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39…

LOW 30

An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0 through 4.7.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.004 Published 2023-12-20 No fix listed

TI-2023-11321 CVE-2023-26095 · GHSA-pp7q-23h5-2fpj

ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3…

MEDIUM 40

ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00616 Published 2023-08-28 No fix listed CWE-20

TI-2022-23134 CVE-2022-46783 · GHSA-hpfr-fh2j-j4m2

An issue was discovered in Stormshield SSL VPN Client before 3.2.0.

LOW 30

An issue was discovered in Stormshield SSL VPN Client before 3.2.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0029 Published 2023-08-28 No fix listed CWE-326

TI-2021-09264 CVE-2021-27932 · GHSA-6wq6-4gh5-p7r9

Stormshield Network Security (SNS) VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions.

LOW 35

Stormshield Network Security (SNS) VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00195 Published 2023-08-25 No fix listed

TI-2020-09402 CVE-2020-11711 · GHSA-v87h-6qr6-59fx

An issue was discovered in Stormshield SNS 3.8.0.

LOW 23

An issue was discovered in Stormshield SNS 3.8.0.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00475 Published 2023-08-25 No fix listed CWE-79

TI-2022-23133 CVE-2022-46782 · GHSA-g2jr-rxc8-f5gf

An issue was discovered in Stormshield SSL VPN Client before 3.2.0.

LOW 35

An issue was discovered in Stormshield SSL VPN Client before 3.2.0.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00189 Published 2023-08-05 No fix listed

TI-2023-17888 CVE-2023-35800 · GHSA-9j35-h8v6-5943

Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions.

LOW 20

Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00385 Published 2023-06-27 No fix listed CWE-732

TI-2023-17887 CVE-2023-35799 · GHSA-ppp2-fxjc-67f9

Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions.

LOW 24

Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0019 Published 2023-06-27 No fix listed CWE-732

TI-2023-09393 CVE-2023-23562 · GHSA-689m-p93h-hrjx

Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that…

LOW 20

Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameters.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00407 Published 2023-05-31 No fix listed

Vulnerabilities

Filters