CVE-2026-111090CWE-287

CVE-2026-111090

High · published October 20, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
1.8
In the wild
Unconfirmed
What it is

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00122 · 1.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-10-20T12:16Z
References (1)
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 20 OCT 07:42Z
    Improper Signature Verification of Firmware Update Files
    cvelistv5
  • 20 OCT 07:42Z
    Improper Signature Verification of Firmware Update Files
    cvelistv5