Stormshield has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 7.0 (high). None have a confirmed exploitation report. The most common weakness class is CWE-79 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Worst active — by depth score
CVE-2026-111090High· 7.8Improper Signature Verification of Firmware Update Files43CVE-2026-113469High· 7.5Improper Signature Verification of Active Update Files41CVE-2026-113810High· 7.0Stored XSS on SNS Enrollment Portal39CVE-2026-113808High· 7.1Stored XSS on SNS Enrollment Portal39CVE-2026-113465Medium· 6.6Possible DOM XSS in SNS Web Administration Portal36
Stormshield vulnerabilities
CVEs affecting Stormshield, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-113810High· 7.0Stored XSS on SNS Enrollment Portal
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during valid…
CVE-2026-111088Medium· 6.5Stored XSS in the VPN logs monitor
A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen.
CVE-2026-113808High· 7.1Stored XSS on SNS Enrollment Portal
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the adm…
CVE-2026-113465Medium· 6.6Possible DOM XSS in SNS Web Administration Portal
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a spec…
CVE-2026-113469High· 7.5Improper Signature Verification of Active Update Files
A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
CVE-2026-111090High· 7.8Improper Signature Verification of Firmware Update Files
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automati…