French Stormshield firewalls could accept unauthenticated updates

How does a firewall know an update really comes from its vendor? By checking its digital signature. On Stormshield Network Security (SNS) firewalls, widely used in French government agencies and companies, this check contained logic errors. The vendor fixed them in advisories published on October 16. CERT-FR, the French government alert center, picked them up in a notice on October 19.

The fixed versions are 5.0.10, 5.1.4 EA and 4.8.20 LTSB (the long-term support branch). All earlier versions of these branches are affected. Stormshield mentions no exploitation by attackers, but says proof-of-concept code exists for the flaws described.

Update files accepted without proof of origin

The vulnerability CVE-2026-111090 (advisory STORM-2026-031) is the most telling. An error in the signature verification routine leads the firewall to accept unauthenticated update and license files. Stormshield rates it medium severity. According to the scoring vector published by the vendor, the attack is local and requires user action. As a workaround, Stormshield recommends downloading update and license files only from MyStormshield servers.

Advisory STORM-2026-032 describes the same type of error in Active Update, the feature that automatically downloads the firewall's dynamic data. Unauthenticated updates could get through. However, the attacker must be on an adjacent network, and the attack is rated complex. Both flaws also affect the 4.3 branch, for which no fix is listed.

A third flaw targets the administrator, a fourth remains under embargo

Advisory STORM-2026-022 concerns the web administration interface of versions 5.0 and 5.1. It is an XSS flaw, which allows code to run in the browser. It can be exploited if a logged-in administrator opens a booby-trapped link. There is no workaround.

Finally, CERT-FR cites a fourth advisory, STORM-2026-030. Stormshield rates it high severity but has not yet published its description or the affected versions. The page says the advisory will be published as soon as all embargo conditions are lifted.

What to do

After the tampered updates of AOMEI backup software, these flaws are a reminder that the update channel is a target in its own right:

• Upgrade to 5.0.10, 5.1.4 EA or 4.8.20 LTSB, depending on your branch.
• If you are still on 4.3, plan the upgrade: no fix is announced for this branch.
• In the meantime, download update and license files only from the MyStormshield portal. Compare their SHA-256 hash with the one published on that portal.
• For Active Update, use the official servers or SMC mirrors, over HTTPS. On a custom update server, enable HTTPS and verify the hashes of the hosted files.
• Avoid opening links you receive during a firewall administration session.

The next step will be the publication of the advisory still under embargo. We will need to check whether the versions already fixed cover it.