CVE-2026-8480

A vulnerability was discovered on Stormshield Network Security 4.3.0  to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included) A revoked client certificate can still be used to authenticate to the captive‑admin portal, allowing an attacker who possesses the revoked certificate to gain administrative access.

Score

CVSS 3.1 4.3 Medium

Status

Awaiting Analysis - cert@airbus.com

Published

2026-07-01

Last modified

2026-10-25

Weaknesses

CWE-295

Affected products

• Stormshield Network Security (Stormshield)

References

• https://advisories.stormshield.eu/2026-002/