Stormshield - vulnerabilities (CVEs)

70 CVEs in 9 products, 6 in the last 30 days, newest from 2026-10-20.

Products

Newest CVEs of Stormshield

CVE-2026-111088 - CVSS 6.5 (medium), 2026-10-20: A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.
CVE-2026-113810 - CVSS 7 (high), 2026-10-20: A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting…
CVE-2026-113808 - CVSS 7.1 (high), 2026-10-20: A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user…
CVE-2026-113469 - CVSS 7.5 (high), 2026-10-20: A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in…
CVE-2026-113465 - CVSS 6.6 (medium), 2026-10-20: It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker…
CVE-2026-111090 - CVSS 7.8 (high), 2026-10-20: A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the…
CVE-2026-14466 - CVSS 4.3 (medium), 2026-09-04: It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions…
CVE-2026-8482 - CVSS 4.3 (medium), 2026-07-02: A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included) There is a…
CVE-2026-8480 - CVSS 4.3 (medium), 2026-07-01: A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included) A…
CVE-2026-8474 - CVSS 5.3 (medium), 2026-06-01: A vulnerability was discovered on Stormshield Network Security * 4.3.0 to 4.3.41, * 4.8.0 to 4.8.15, * 5.0.0 to 5.0.5 It is possible to execute a reflected…
CVE-2025-48707 - CVSS 7.5 (high), 2025-09-25: An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in some HA use cases, be shared among…
CVE-2024-37386 - CVSS 4.2 (medium), 2024-07-15: An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Certain manipulations allow restarting in…
CVE-2023-41165 - CVSS 4.8 (medium), 2024-02-29: An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21…
CVE-2023-34198 - CVSS 7.3 (high), 2024-02-29: In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0…
CVE-2023-28616 - CVSS 7.5 (high), 2023-12-26: An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user…
CVE-2023-47091 - CVSS 7.5 (high), 2023-12-25: An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0…
CVE-2023-47093 - CVSS 6.5 (medium), 2023-12-21: An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. Sending a crafted ICMP packet may lead to…
CVE-2023-41166 - CVSS 5.3 (medium), 2023-12-21: An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and…
CVE-2022-46783 - CVSS 5.3 (medium), 2023-08-28: An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access the other encrypted…
CVE-2023-26095 - CVSS 7.5 (high), 2023-08-28: ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet.
CVE-2021-27932 - CVSS 7.8 (high), 2023-08-25: Stormshield Network Security (SNS) VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions.
CVE-2020-11711 - CVSS 4.8 (medium), 2023-08-25: An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer…
CVE-2022-46782 - CVSS 7.8 (high), 2023-08-05: An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to…
CVE-2023-35800 - CVSS 4.3 (medium), 2023-06-27: Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the…
CVE-2023-35799 - CVSS 5.5 (medium), 2023-06-27: Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary…
CVE-2023-23562 - CVSS 4.3 (medium), 2023-05-31: Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameters.
CVE-2023-23561 - CVSS 5.5 (medium), 2023-05-30: Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.
CVE-2023-20052 - CVSS 5.3 (medium), 2023-03-01: On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and…
CVE-2023-20032 - CVSS 9.8 (critical), 2023-03-01: On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV…
CVE-2023-0286 - CVSS 7.4 (high), 2023-02-08: There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but…