CVE-2026-8480 PUBLISHED

Connection possible to the Administration portal with a revoked certificate

Assigner: airbus
Reserved: 13.05.2026 Published: 01.07.2026 Updated: 01.07.2026

A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included)

A revoked client certificate can still be used to authenticate to the captive‑admin portal, allowing an attacker who possesses the revoked certificate to gain administrative access.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Attack Vector	Adjacent Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Stormshield
Product	Stormshield Network Security
Versions	Default: unknown affected from 4.3.0 to 4.3.41 (incl.) affected from 4.4.0 to 4.8.15 (incl.) affected from 5.0.2 EA to 5.0.5 (incl.)

Solutions

The following updates fix this vulnerability: * SNS 5.0.6

SNS 4.8.16
SNS 4.3.42

References

https://advisories.stormshield.eu/2026-002/

Problem Types

CWE-295 Improper certificate validation CWE