Stormshield
Vulnerability activity for Stormshield: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.0HighOct 20, 2026Stormshield Network Security XSSCVE-2026-113810A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.
- 7.1HighOct 20, 2026Stormshield Network Security XSSCVE-2026-113808A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.
- 6.5MediumOct 20, 2026Stormshield Network Security XSSCVE-2026-111088A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.
- 7.5HighOct 20, 2026Stormshield Network Security Auth bypass / access controlCVE-2026-113469A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
- 6.6MediumOct 20, 2026Stormshield Network Security XSSCVE-2026-113465It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.
- 7.8HighOct 20, 2026Stormshield Network Security Auth bypass / access controlCVE-2026-111090A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
- 4.3MediumSep 4, 2026Stormshield Network Security XSSCVE-2026-14466It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface.
- 7.5HighSep 25, 2025stormshield network security Auth bypass / access controlCVE-2025-48707An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in some HA use cases, be shared among administrators, which can cause secret sharing.
Top products
- Stormshield Network Security7 CVEs in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.