{"api_version":"1","generated_at":"2026-10-21T23:53:07+00:00","cve":"CVE-2026-113469","urls":{"html":"https://cve.report/CVE-2026-113469","api":"https://cve.report/api/cve/CVE-2026-113469.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-113469","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-113469"},"summary":{"title":"Improper Signature Verification of Active Update Files","description":"A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.","state":"PUBLISHED","assigner":"airbus","published_at":"2026-10-20 09:17:09","updated_at":"2026-10-20 19:35:23"},"problem_types":["CWE-287","CWE-287 CWE-287: Improper Authentication"],"metrics":[{"version":"3.1","source":"cert@airbus.com","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://advisories.stormshield.eu/2026-032/","name":"https://advisories.stormshield.eu/2026-032/","refsource":"cert@airbus.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-113469","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113469","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Stormshield","product":"Stormshield Network Security","version":"affected 4.3.0 4.3.44 semver","platforms":[]},{"source":"CNA","vendor":"Stormshield","product":"Stormshield Network Security","version":"affected 4.8.0 4.8.19 semver","platforms":[]},{"source":"CNA","vendor":"Stormshield","product":"Stormshield Network Security","version":"affected 5.0.0 5.0.9 semver","platforms":[]},{"source":"CNA","vendor":"Stormshield","product":"Stormshield Network Security","version":"affected 5.1.0 5.1.3 semver","platforms":[]},{"source":"CNA","vendor":"Stormshield","product":"Stormshield Network Security","version":"unaffected 4.8.20 LTSB semver","platforms":[]},{"source":"CNA","vendor":"Stormshield","product":"Stormshield Network Security","version":"unaffected 5.0.10 semver","platforms":[]},{"source":"CNA","vendor":"Stormshield","product":"Stormshield Network Security","version":"unaffected 5.1.4 EA","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"The following updates will fix this vulnerability:\n\n  *  SNS 5.1.4 EA\n  *  SNS 5.0.10\n  *  SNS 4.8.20 LTSB","time":"","lang":"en"}],"workarounds":[{"source":"CNA","title":"","value":"*  Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.\n  *  If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.","time":"","lang":"en"}],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"113469","cve":"CVE-2026-113469","epss":"0.001550000","percentile":"0.042220000","score_date":"2026-10-20","updated_at":"2026-10-21 00:14:27"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-113469","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-20T15:15:05.318940Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-20T18:08:00.762Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Stormshield Network Security","vendor":"Stormshield","versions":[{"lessThanOrEqual":"4.3.44","status":"affected","version":"4.3.0","versionType":"semver"},{"lessThanOrEqual":"4.8.19","status":"affected","version":"4.8.0","versionType":"semver"},{"lessThanOrEqual":"5.0.9","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"5.1.3","status":"affected","version":"5.1.0","versionType":"semver"},{"status":"unaffected","version":"4.8.20 LTSB","versionType":"semver"},{"status":"unaffected","version":"5.0.10","versionType":"semver"},{"status":"unaffected","version":"5.1.4 EA"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>A failure has been identified in the SNS during dynamic data files signature check.</p><p>A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.</p>"}],"value":"A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"CWE-287: Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-20T08:29:49.095Z","orgId":"24a3c815-5f22-4d74-967a-30958d6466f4","shortName":"airbus"},"references":[{"url":"https://advisories.stormshield.eu/2026-032/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>The following updates will fix this vulnerability:</p><ul><li>SNS 5.1.4 EA</li><li>SNS 5.0.10</li><li>SNS 4.8.20 LTSB</li></ul>"}],"value":"The following updates will fix this vulnerability:\n\n  *  SNS 5.1.4 EA\n  *  SNS 5.0.10\n  *  SNS 4.8.20 LTSB"}],"source":{"discovery":"UNKNOWN"},"title":"Improper Signature Verification of Active Update Files","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<ul><li>Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.</li><li>If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers.</li></ul>"}],"value":"*  Use only official Stormshield update servers or SMC mirror servers, if configured, ensuring that HTTPS is enabled.\n  *  If you use custom update servers, ensure that HTTPS is enabled and verify that the SHA-256 hashes of the files hosted on your servers match those obtained from the official Stormshield update servers."}],"x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"24a3c815-5f22-4d74-967a-30958d6466f4","assignerShortName":"airbus","cveId":"CVE-2026-113469","datePublished":"2026-10-20T08:29:49.095Z","dateReserved":"2026-10-20T08:23:20.615Z","dateUpdated":"2026-10-20T18:08:00.762Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-20 09:17:09","lastModifiedDate":"2026-10-20 19:35:23","problem_types":["CWE-287","CWE-287 CWE-287: Improper Authentication"],"metrics":{"cvssMetricV31":[{"source":"cert@airbus.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-20T15:15:05.318940Z","id":"CVE-2026-113469","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"113469","Ordinal":"1","Title":"Improper Signature Verification of Active Update Files","CVE":"CVE-2026-113469","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"113469","Ordinal":"1","NoteData":"A failure has been identified in the SNS during dynamic data files signature check.\n\n\n\nA logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.","Type":"Description","Title":"Improper Signature Verification of Active Update Files"}]}}}