EUVD-2026-41043
GHSA-2j5q-9jw8-9qj5
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Adjacent network required (AV:A); admin portal access implies full config read (C:H) and write (I:H); no direct availability impact described.
Primary rating from Vendor (airbus).
CVSS VectorVendor: airbus
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included)
A revoked client certificate can still be used to authenticate to the captive‑admin portal, allowing an attacker who possesses the revoked certificate to gain administrative access.
AnalysisAI
Administrative access to the Stormshield Network Security captive-admin portal is bypassed when an attacker presents a revoked client certificate, because the portal does not enforce certificate revocation checks during TLS mutual authentication. Affected versions span three branches: 4.3.0-4.3.41, 4.4.0-4.8.15, and 5.0.2 EA-5.0.5. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the threat actor population is meaningfully constrained - exploitation requires prior possession of a certificate that was specifically issued for this portal and then revoked.
Technical ContextAI
The root cause is CWE-295 (Improper Certificate Validation): the captive-admin portal performs TLS client certificate authentication but does not verify revocation status via CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol). In a correctly implemented PKI-based authentication flow, a revoked certificate should be rejected at the TLS handshake stage; here it is accepted as valid. The affected product is Stormshield Network Security (SNS), a French network firewall and UTM appliance, per CPE cpe:2.3:a:stormshield:stormshield_network_security across the listed version branches. The captive-admin portal is a dedicated administrative management interface. Certificate revocation is a fundamental lifecycle control used when administrator credentials are compromised or personnel are offboarded; its absence in revocation enforcement invalidates that control entirely.
RemediationAI
Consult the Stormshield advisory at https://advisories.stormshield.eu/2026-002/ for the vendor-released patch; the exact fixed version number is not specified in available intelligence and cannot be independently confirmed. As an immediate compensating control, restrict network access to the captive-admin portal using firewall ACLs or management VLAN segmentation so that only trusted hosts on dedicated management segments can reach it, reducing the AV:A attack surface to a narrower population. Organizations should also audit all currently revoked certificates and, where feasible, re-issue certificates for active administrators from a new CA or with a new serial, effectively rendering any in-scope revoked certificates entirely invalid even without portal-side enforcement. If the portal supports IP-based access restrictions, enable them immediately. Note: restricting access does not fix the revocation check failure - it only reduces the window of exposure until the patch can be applied.
More in Stormshield Network Security
View allzlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
The L2TP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted L2TP control packet
The PPP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted PPP authentication m
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ p
An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. Rated high severity (CVSS 7.5), this vulnera
An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x
An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through
ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a cr
strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a craft
Flooding SNS firewall versions 3.7.0 to 3.7.29, 3.11.0 to 3.11.17, 4.2.0 to 4.2.10, and 4.3.0 to 4.3.6 with specific for
An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.8. Rated high severity (CVSS 7.5), this v
In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x b
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today