What’s Vulnerable › Vulnerabilities
CVE-2026-8480: Connection possible to the Administration portal with a revoked certificate
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-01 · updated 2026-10-25
- Weakness: CWE-295
Description
A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included) A revoked client certificate can still be used to authenticate to the captive‑admin portal, allowing an attacker who possesses the revoked certificate to gain administrative access.
Affected products
- Stormshield Network Security: from 4.3.0 through 4.3.41; from 4.4.0 through 4.8.15; from 5.0.2 EA through 5.0.5
References
Get alerted when CVE-2026-8480 or the next vulnerability affects your stack