{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-113469", "assignerOrgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "state": "PUBLISHED", "assignerShortName": "airbus", "dateReserved": "2026-10-20T08:23:20.615Z", "datePublished": "2026-10-20T08:29:49.095Z", "dateUpdated": "2026-10-20T08:29:49.095Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "shortName": "airbus", "dateUpdated": "2026-10-20T08:29:49.095Z"}, "title": "Improper Signature Verification of Active Update Files", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "affected": [{"vendor": "Stormshield", "product": "Stormshield Network Security", "versions": [{"status": "affected", "version": "4.3.0", "lessThanOrEqual": "4.3.44", "versionType": "semver"}, {"status": "affected", "version": "4.8.0", "lessThanOrEqual": "4.8.19", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThanOrEqual": "5.0.9", "versionType": "semver"}, {"status": "affected", "version": "5.1.0", "lessThanOrEqual": "5.1.3", "versionType": "semver"}, {"status": "unaffected", "version": "4.8.20 LTSB", "versionType": "semver"}, {"status": "unaffected", "version": "5.0.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.1.4 EA"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A failure has been identified in the SNS during dynamic data files signature check.</p><p>A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.</p>"}]}], "references": [{"url": "https://advisories.stormshield.eu/2026-032/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "workarounds": [{"lang": "en", "value": "* Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.\n * If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<ul><li>Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.</li><li>If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.</li></ul>"}]}], "solutions": [{"lang": "en", "value": "The following updates will fix this vulnerability:\n\n * SNS 5.1.4 EA\n * SNS 5.0.10\n * SNS 4.8.20 LTSB", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The following updates will fix this vulnerability:</p><ul><li>SNS 5.1.4 EA</li><li>SNS 5.0.10</li><li>SNS 4.8.20 LTSB</li></ul>"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Stormshield Network Security", "vendor": "Stormshield", "versions": [{"lessThanOrEqual": "4.3.44", "status": "affected", "version": "4.3.0", "versionType": "semver"}, {"lessThanOrEqual": "4.8.19", "status": "affected", "version": "4.8.0", "versionType": "semver"}, {"lessThanOrEqual": "5.0.9", "status": "affected", "version": "5.0.0", "versionType": "semver"}, {"lessThanOrEqual": "5.1.3", "status": "affected", "version": "5.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "4.8.20 LTSB", "versionType": "semver"}, {"status": "unaffected", "version": "5.0.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.1.4 EA"}]}], "source": "cert@airbus.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine."}], "id": "CVE-2026-113469", "lastModified": "2026-10-20T09:17:09.587", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "cert@airbus.com", "type": "Secondary"}]}, "published": "2026-10-20T09:17:09.587", "references": [{"source": "cert@airbus.com", "url": "https://advisories.stormshield.eu/2026-032/"}], "sourceIdentifier": "cert@airbus.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "cert@airbus.com", "type": "Secondary"}]}

{}

{}