Multiple Vulnerabilities in Stormshield Network Security

The French National Cybersecurity Agency (ANSSI) has issued an advisory regarding multiple vulnerabilities identified in Stormshield Network Security (SNS) devices. These vulnerabilities, detailed across four separate Stormshield security bulletins (STORM-2026-022, STORM-2026-030, STORM-2026-031, and STORM-2026-032), affect various branches of the SNS firmware, including versions 4.8.x, 5.0.x, and 5.1.x. The flaws present significant operational risks, including potential unauthorized modification of data, circumvention of established security filtering policies, and remote cross-site scripting (XSS) vectors. The identified vulnerabilities pose a critical risk to perimeter security posture, as the firewall could be leveraged as a vector for internal network exploitation or unauthorized traffic bypass if successfully targeted.

Impact

Successful exploitation of these vulnerabilities could result in full or partial compromise of the network security gateway's integrity. Potential impacts include unauthorized access to internal resources by bypassing firewall policies, loss of data integrity within the security appliance, and browser-based attacks against administrators via XSS. Given the role of these devices as primary network gateways, exploitation could facilitate lateral movement or data exfiltration.

Recommendation

• Immediately update Stormshield Network Security (SNS) appliances to the patched firmware versions recommended in the manufacturer's bulletins: STORM-2026-022, STORM-2026-030, STORM-2026-031, and STORM-2026-032.
• Review the specific patch requirements for the identified affected versions: upgrade to version 5.0.10 or later for 5.0.x, 5.1.4 EA or later for 5.1.x, and 4.8.20 LTSB or later for 4.8.x.
• Restrict administrative access to the firewall management interface to trusted, internal IP ranges only to mitigate the impact of potential XSS or policy bypass attempts.
• Monitor logs for unusual administrative login patterns or unexpected configuration changes that may indicate exploitation of policy bypass vulnerabilities.