{"id":"CVE-2026-8480","aliases":["EUVD-2026-41043","GHSA-2j5q-9jw8-9qj5"],"status":"published","title":"Connection possible to the Administration portal with a revoked certificate","description":"A vulnerability was discovered on Stormshield Network Security 4.3.0  to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included)\n\n\n\nA revoked client certificate can still be used to authenticate to the captive‑admin portal, allowing an attacker who possesses the revoked certificate to gain administrative access.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00126,"percentile":0.0232,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-295"],"published":"2026-07-01T14:52:12Z","modified":"2026-10-25T17:10:00Z","products":[{"vendor":"stormshield","product":"stormshield network security"}],"references":[{"url":"https://advisories.stormshield.eu/2026-002/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8480"},{"url":"https://advisories.stormshield.eu/2026-002"},{"url":"https://github.com/advisories/GHSA-2j5q-9jw8-9qj5"}],"sources":{"cve":[{"id":"CVE-2026-8480","title":"Connection possible to the Administration portal with a revoked certificate","description":"A vulnerability was discovered on Stormshield Network Security 4.3.0  to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included)\n\n\n\nA revoked client certificate can still be used to authenticate to the captive‑admin portal, allowing an attacker who possesses the revoked certificate to gain administrative access.","status":"published","published":"2026-07-01T14:52:12.815Z","modified":"2026-07-01T15:45:32.124Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-41043","description":"A vulnerability was discovered on Stormshield Network Security 4.3.0  to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included)\n\n\n\nA revoked client certificate can still be used to authenticate to the captive‑admin portal, allowing an attacker who possesses the revoked certificate to gain administrative access.","status":"published","published":"2026-07-01T14:52:12Z","modified":"2026-07-01T15:45:32Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:19.446061Z"}],"ghsa":[{"id":"GHSA-2j5q-9jw8-9qj5","title":"A vulnerability was discovered on Stormshield Network Security 4.3.0  to 4.3.41 (included), 4.4.0...","description":"A vulnerability was discovered on Stormshield Network Security 4.3.0  to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included)\n\n\n\nA revoked client certificate can still be used to authenticate to the captive‑admin portal, allowing an attacker who possesses the revoked certificate to gain administrative access.","status":"published","published":"2026-07-01T18:31:51Z","modified":"2026-07-01T18:31:59Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:09:09.679694Z"}],"nvd":[{"id":"CVE-2026-8480","description":"A vulnerability was discovered on Stormshield Network Security 4.3.0  to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included)\n\n\n\nA revoked client certificate can still be used to authenticate to the captive‑admin portal, allowing an attacker who possesses the revoked certificate to gain administrative access.","status":"published","published":"2026-07-01T16:16:53.73Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:27.199837Z"}]}}