CVE-2026-113469

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-113469", "assignerOrgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "state": "PUBLISHED", "assignerShortName": "airbus", "dateReserved": "2026-10-20T08:23:20.615Z", "datePublished": "2026-10-20T08:29:49.095Z", "dateUpdated": "2026-10-20T18:08:00.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "shortName": "airbus", "dateUpdated": "2026-10-20T08:29:49.095Z"}, "title": "Improper Signature Verification of Active Update Files", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "affected": [{"vendor": "Stormshield", "product": "Stormshield Network Security", "versions": [{"status": "affected", "version": "4.3.0", "lessThanOrEqual": "4.3.44", "versionType": "semver"}, {"status": "affected", "version": "4.8.0", "lessThanOrEqual": "4.8.19", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThanOrEqual": "5.0.9", "versionType": "semver"}, {"status": "affected", "version": "5.1.0", "lessThanOrEqual": "5.1.3", "versionType": "semver"}, {"status": "unaffected", "version": "4.8.20 LTSB", "versionType": "semver"}, {"status": "unaffected", "version": "5.0.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.1.4 EA"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A failure has been identified in the SNS during dynamic data files signature check.</p><p>A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.</p>"}]}], "references": [{"url": "https://advisories.stormshield.eu/2026-032/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "workarounds": [{"lang": "en", "value": "* Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.\n * If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<ul><li>Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.</li><li>If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.</li></ul>"}]}], "solutions": [{"lang": "en", "value": "The following updates will fix this vulnerability:\n\n * SNS 5.1.4 EA\n * SNS 5.0.10\n * SNS 4.8.20 LTSB", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The following updates will fix this vulnerability:</p><ul><li>SNS 5.1.4 EA</li><li>SNS 5.0.10</li><li>SNS 4.8.20 LTSB</li></ul>"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-113469", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-20T15:15:05.318940Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T18:08:00.762Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-113469", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-20T15:15:05.318940Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T18:07:40.402Z"}}], "cna": {"title": "Improper Signature Verification of Active Update Files", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Stormshield", "product": "Stormshield Network Security", "versions": [{"status": "affected", "version": "4.3.0", "versionType": "semver", "lessThanOrEqual": "4.3.44"}, {"status": "affected", "version": "4.8.0", "versionType": "semver", "lessThanOrEqual": "4.8.19"}, {"status": "affected", "version": "5.0.0", "versionType": "semver", "lessThanOrEqual": "5.0.9"}, {"status": "affected", "version": "5.1.0", "versionType": "semver", "lessThanOrEqual": "5.1.3"}, {"status": "unaffected", "version": "4.8.20 LTSB", "versionType": "semver"}, {"status": "unaffected", "version": "5.0.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.1.4 EA"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "The following updates will fix this vulnerability:\n\n * SNS 5.1.4 EA\n * SNS 5.0.10\n * SNS 4.8.20 LTSB", "supportingMedia": [{"type": "text/html", "value": "<p>The following updates will fix this vulnerability:</p><ul><li>SNS 5.1.4 EA</li><li>SNS 5.0.10</li><li>SNS 4.8.20 LTSB</li></ul>", "base64": false}]}], "references": [{"url": "https://advisories.stormshield.eu/2026-032/"}], "workarounds": [{"lang": "en", "value": "* Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.\n * If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.", "supportingMedia": [{"type": "text/html", "value": "<ul><li>Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.</li><li>If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.</li></ul>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.", "supportingMedia": [{"type": "text/html", "value": "<p>A failure has been identified in the SNS during dynamic data files signature check.</p><p>A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "shortName": "airbus", "dateUpdated": "2026-10-20T08:29:49.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-113469", "state": "PUBLISHED", "dateUpdated": "2026-10-20T18:08:00.762Z", "dateReserved": "2026-10-20T08:23:20.615Z", "assignerOrgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "datePublished": "2026-10-20T08:29:49.095Z", "assignerShortName": "airbus"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Stormshield Network Security", "vendor": "Stormshield", "versions": [{"lessThanOrEqual": "4.3.44", "status": "affected", "version": "4.3.0", "versionType": "semver"}, {"lessThanOrEqual": "4.8.19", "status": "affected", "version": "4.8.0", "versionType": "semver"}, {"lessThanOrEqual": "5.0.9", "status": "affected", "version": "5.0.0", "versionType": "semver"}, {"lessThanOrEqual": "5.1.3", "status": "affected", "version": "5.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "4.8.20 LTSB", "versionType": "semver"}, {"status": "unaffected", "version": "5.0.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.1.4 EA"}]}], "source": "cert@airbus.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine."}], "id": "CVE-2026-113469", "lastModified": "2026-10-20T19:35:23.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "cert@airbus.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-113469", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T15:15:05.318940Z", "version": "2.0.3"}}]}, "published": "2026-10-20T09:17:09.587", "references": [{"source": "cert@airbus.com", "url": "https://advisories.stormshield.eu/2026-032/"}], "sourceIdentifier": "cert@airbus.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "cert@airbus.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.3.0,4.3.44]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.8.0,4.8.19]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.0.9]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.1.0,5.1.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "4.8.20 LTSB"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.0.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "5.1.4 EA"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Stormshield Network Security", "source": "cna", "vendor": "Stormshield"}, "product": "stormshield_network_security", "vendor": "stormshield"}], "created": "2026-10-20T16:30:06.789544+00:00", "updated": "2026-10-20T16:45:13.877910+00:00", "vendors": ["stormshield", "stormshield$PRODUCT$stormshield_network_security"]}