CVE-2026-8480: Stormshield Network Auth Bypass Vulnerability

CVE-2026-8480 Overview

CVE-2026-8480 is an improper certificate validation flaw [CWE-295] affecting Stormshield Network Security (SNS) firewall appliances. The captive-admin portal accepts client certificates that have been revoked, permitting an attacker who holds a revoked certificate to authenticate and gain administrative access. The weakness arises because the portal does not consult certificate revocation status during the TLS client-authentication step.

Affected versions include Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included), and 5.0.2 EA to 5.0.5 (included).

Critical Impact
An attacker with adjacent network access and possession of a revoked client certificate can obtain administrative access to the SNS captive-admin portal, undermining the certificate revocation control.

Affected Products

Stormshield Network Security 4.3.0 through 4.3.41
Stormshield Network Security 4.4.0 through 4.8.15
Stormshield Network Security 5.0.2 EA through 5.0.5

Discovery Timeline

2026-07-01 - CVE-2026-8480 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-8480

Vulnerability Analysis

CVE-2026-8480 is an improper certificate validation vulnerability in the captive-admin portal component of Stormshield Network Security. During mutual TLS authentication, the portal validates the client certificate chain and signature but does not enforce a revocation check against the issuing Certificate Authority. As a result, a certificate that has been added to a Certificate Revocation List (CRL) or marked revoked via the Online Certificate Status Protocol (OCSP) continues to be treated as valid credentials for administrative login.

Because the captive-admin portal grants administrative privileges once authenticated, a bypass of the revocation step maps directly to unauthorized administrative access to the appliance. The flaw is classified under [CWE-295] Improper Certificate Validation.

Root Cause

The root cause is the omission of revocation status verification in the certificate validation pipeline used by the captive-admin portal. Administrators can revoke a certificate through the internal PKI, yet the portal continues to accept the revoked certificate for authentication. The system relies solely on trust chain and expiry checks rather than incorporating CRL or OCSP responses into the accept-or-reject decision.

Attack Vector

The attack requires adjacent network access to the captive-admin interface and possession of a previously issued but revoked client certificate. Typical scenarios include a former administrator whose certificate was revoked after offboarding, a compromised certificate that was later revoked, or a certificate reissued to a new holder while the prior key material remained in adversary hands. The attacker presents the revoked certificate during the TLS handshake and receives administrative access to the portal.

No verified exploit code has been published. Refer to the Stormshield Security Advisory 2026-002 for vendor-supplied technical details.

Detection Methods for CVE-2026-8480

Indicators of Compromise

Successful captive-admin portal logins using client certificates whose serial numbers appear on the internal CRL.
Administrative sessions originating from IP addresses or subnets that do not match expected administrator source ranges.
Configuration changes on SNS appliances that cannot be correlated to an authorized administrator session.

Detection Strategies

Correlate captive-admin authentication events with the current CRL and flag any authentication that used a listed serial number.
Alert on logins by certificates issued to identities that have been offboarded or whose credentials were rotated.
Baseline administrator source addresses and user agents, then alert on deviations against the SNS management plane.

Monitoring Recommendations

Forward SNS authentication and audit logs to a central SIEM and retain them for at least 90 days.
Monitor for unexpected administrative actions such as rule changes, account creation, or VPN configuration edits following portal logins.
Track TLS client-authentication attempts on the captive-admin listener and record the presented certificate serial numbers for post-hoc verification.

How to Mitigate CVE-2026-8480

Immediate Actions Required

Upgrade Stormshield Network Security to a fixed version as specified in Stormshield Security Advisory 2026-002.
Reissue and redistribute administrator client certificates, and confirm that revocation is enforced after patching.
Restrict network reachability of the captive-admin portal to a dedicated management network or trusted jump hosts.

Patch Information

Stormshield has published fixes in Security Advisory 2026-002. Administrators running versions 4.3.0 to 4.3.41, 4.4.0 to 4.8.15, or 5.0.2 EA to 5.0.5 must upgrade to the vendor-recommended fixed release. Consult the Stormshield Security Advisory 2026-002 for the specific target versions and upgrade path applicable to each branch.

Workarounds

Limit access to the captive-admin portal to an isolated management VLAN so adjacent network access is not achievable from user or guest segments.
Rotate the administrative PKI: revoke existing certificates, issue new ones, and remove trust for any CA that issued potentially compromised credentials.
Enable multi-factor authentication on administrative accounts where supported, so a valid certificate alone is insufficient for access.

bash

# Configuration example
# Restrict captive-admin reachability to a management subnet using an SNS filter rule
# (adapt object names to your environment)
CONFIG FILTER RULE INSERT index=1 \
  action=block \
  srcif=any \
  src=any \
  dst=Firewall_captive_admin \
  dstport=captive_admin_https
CONFIG FILTER RULE INSERT index=2 \
  action=pass \
  srcif=mgmt_vlan \
  src=Admin_Workstations \
  dst=Firewall_captive_admin \
  dstport=captive_admin_https
CONFIG FILTER ACTIVATE