Stormshield Network Security CVE-2026-8480

Three specific prerequisites must be met: (1) the attacker must possess a client certificate that was previously issued for authentication to the SNS captive-admin portal and has since been revoked - arbitrary certificates or certificates for other systems are not usable; (2) the attacker must have adjacent network access to the captive-admin portal's listening interface (AV:A - not exploitable from the open internet unless the portal is explicitly internet-exposed, which would be atypical for a management interface); (3) the target SNS instance must be running one of the affected version branches (4.3.0-4.3.41, 4.4.0-4.8.15, or 5.0.2 EA-5.0.5) with the captive-admin portal feature active. What limits exploitation: the attacker must already hold a specific revoked certificate issued for this portal, which significantly constrains the threat actor population to insiders, ex-administrators, or actors who have separately compromised a certificate. The PR:N CVSS rating reflects that the portal itself provides no barrier once the certificate is presented, but possession of the certificate is a substantial prerequisite.

The vendor-assigned CVSS 3.1 score of 4.3 (Medium, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) significantly understates real-world impact for environments using client certificate authentication for SNS administration. The C:L/I:N/A:N impact tuple treats this as a minor information disclosure, but administrative portal access to a network security appliance realistically implies full exposure of security policy configuration, VPN credentials, network topology data, and the ability to alter firewall rules - warranting C:H/I:H in an independent assessment. The AV:A (Adjacent Network) vector appropriately limits exposure to actors who can reach the captive-admin portal's network segment. No EPSS score was provided, KEV status is absent (no confirmed active exploitation), and no POC has been published. The primary real-world risk vector is insider threat or ex-administrator scenarios where a revoked certificate remains in an attacker's possession. EPSS and active exploitation data are missing - risk prioritization should be weighted by whether certificate revocation is actively relied upon in the affected environment's PKI.

A former administrator whose client certificate was revoked after offboarding connects to the internal management network segment hosting the SNS captive-admin portal. Using standard TLS client tooling (e.g., curl with the certificate and key files), they authenticate to the portal - the portal accepts the revoked certificate without checking revocation status and grants full administrative access to the firewall appliance. No public exploit code is available; the attack requires only possession of the revoked certificate file and network adjacency.