Stormshield Network Security EUVD-2026-104841

Exploitation requires that the appliance's Autoupdate routine fetch dynamic data files AND that the attacker can supply or tamper with those files reaching the device - i.e., an adjacent-network/man-in-the-middle position on the update channel (AV:A). The flaw is a logic error in the signature-verification routine, so no credentials are needed (PR:N) and no user interaction is required (UI:N), but the high attack complexity (AC:H) means the attacker must successfully interpose on or race the update fetch, which is the principal limiting factor. Exploitation is bounded to environments where Autoupdate is in use and the attacker can influence the update path.

This is a genuine integrity/trust-boundary flaw rather than an inflated high-CVSS issue, but several signals temper its urgency. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N) scores 7.5 and tells a coherent story: no authentication is required (PR:N), but the attacker must be on the adjacent network and overcome high attack complexity (AC:H) - consistent with a logic error that is only reachable by interposing on or racing the Autoupdate channel rather than a trivially remote bug. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the realistic risk is therefore a capable network-positioned attacker (e.g., MITM) rather than opportunistic mass exploitation. CWE-287 (Improper Authentication) matches the described signature-verification bypass. One point to verify: the input CVSS marks C:H alongside I:H/A:H, yet the described defect is fundamentally an integrity failure (accepting unauthenticated update data) - the confidentiality impact is a downstream consequence of pushing a malicious update, not a direct disclosure, so operators should treat the integrity impact as primary. No SSVC decision data was provided.

An attacker positioned on the adjacent network (e.g., able to intercept or spoof the appliance's Autoupdate traffic) serves a crafted dynamic data file. Because the signature-verification routine contains a logic error, the unauthenticated/forged update is accepted during the Autoupdate routine, letting the attacker push malicious data to the Stormshield Network Security appliance. No public proof-of-concept is available, and the high attack complexity means the attacker must reliably win a network-interposition or timing condition.