Summary
- CERT-FR published a new Stormshield advisory on 21 October, incorporating seven manufacturer bulletins issued on 16 and 20 October.
- Affected products include Stormshield Network Security and Stormshield Management Center, with different fixes required across supported branches.
- The vulnerabilities are distinct from those in CERT-FR's 19 October Stormshield notice, already reported by Cyber Insider.
France’s national cybersecurity response service has issued a further warning about vulnerabilities affecting Stormshield firewalls and central management software, including weaknesses that could permit arbitrary code execution, security policy bypass and service disruption.
The CERT-FR published advisory CERTFR-2026-AVI-1345 on 21 October, drawing together seven manufacturer bulletins issued on 16 and 20 October. It identifies vulnerabilities affecting Stormshield Network Security and Stormshield Management Center, the platform used to administer multiple security appliances.
The new notice follows a separate CERT-FR advisory dated 19 October, but refers to a different group of Stormshield security bulletins. Although some affected software branches overlap, the latest warning documents additional disclosures rather than repeating the earlier set.
CERT-FR identifies possible consequences including loss of data confidentiality, security policy bypass, remote denial of service, arbitrary code execution, cross-site scripting and SQL injection. These are risks associated with the advisory as a whole; the authority does not state that every affected product is exposed to every consequence.
Central management software joins the affected products
Stormshield Network Security appliances enforce traffic rules and access restrictions at network boundaries. Depending on their configuration, they may protect connections between internal networks, remote users, business applications and external services.
Stormshield Management Center performs a different function, providing central administration of security appliances and their configurations. A weakness in that management environment can raise separate concerns from vulnerabilities in the appliances themselves.
The latest advisory identifies Stormshield Management Center 3.9 releases earlier than 3.9.3 as affected. For Stormshield Network Security, it lists version 4.3 releases earlier than 4.3.45 QS, version 4.8 releases earlier than 4.8.20 LTSB, version 5.0 releases earlier than 5.0.10 and version 5.1 releases earlier than 5.1.4 EA.
Those thresholds apply to separate software branches. The vendor’s correction for a newer feature release is not necessarily an appropriate replacement for an installation maintained on a long-term support branch.
Organisations operating both products consequently need to examine their management platform and network appliances individually. Updating an affected firewall does not automatically correct a vulnerability in the application responsible for administering it.
The same distinction applies across sites. One organisation may operate different firmware branches because of hardware compatibility, established network configurations or supplier maintenance arrangements.
Its exposure cannot therefore be established from the presence of the Stormshield brand alone. The installed product, software version and vulnerable functionality determine which manufacturer bulletin and corrective release are applicable.
The advisory covers several different technical risks
CERT-FR lists arbitrary code execution among the consequences of the vulnerabilities. That category concerns the possibility of running unintended instructions in an affected execution environment, although the impact depends on the vulnerability’s conditions and the privileges available to the compromised component.
Remote denial of service presents a different risk: the disruption of a product’s availability or a function on which protected services depend. A successful denial-of-service attack does not, by itself, establish that an attacker obtained administrative access or extracted data.
The advisory also references security policy bypass, which is particularly relevant to products deployed to enforce restrictions on network traffic or administrative functions.
SQL injection concerns the handling of data used in database queries, while cross-site scripting involves unintended client-side code execution in an affected application context. Their consequences depend on the software component and conditions described in the relevant manufacturer bulletin.
The categories must be kept separate when evaluating a deployment. A product affected by a cross-site scripting issue should not automatically be described as vulnerable to remote system takeover, and the presence of a SQL injection weakness does not establish that information has been stolen.
CERT-FR has consolidated the manufacturer disclosures to alert affected organisations, but it directs them to Stormshield’s individual bulletins for detailed remediation requirements.
The French advisory does not identify confirmed victims or state that the disclosed vulnerabilities are being actively exploited.
Seven bulletins extend October’s security disclosures
The 21 October notice references STORM-2026-026, STORM-2026-027, STORM-2026-028 and STORM-2026-029, all dated 16 October, alongside STORM-2026-023, STORM-2026-024 and STORM-2026-025, dated 20 October.
By contrast, the earlier CERT-FR notice referenced STORM-2026-022 and STORM-2026-030 through STORM-2026-032, all dated 16 October.
The distinction is relevant to patch records. An appliance owner who responded to the first advisory cannot assume that every vulnerability covered by the later notice has also been addressed without checking the corresponding manufacturer bulletins.
There is also an operational difference between correcting a network appliance and changing a central administration service. The former can affect traffic inspection, routing and remote access, while the latter may influence how security policies are distributed and managed across several installations.
Where updates require maintenance windows or compatibility testing, the specific vulnerability and available correction need to be reconciled with the service’s operational role.
That assessment is especially important for security infrastructure because changes that interrupt connectivity may affect systems outside the appliance or management platform itself.
The presence of several vulnerabilities in one national notice does not establish a common attack chain. CERT-FR describes multiple weaknesses across affected products, and the manufacturer retains responsibility for identifying the individual technical conditions and fixes.
Its two October notices together cover a broader set of Stormshield disclosures than either contains independently. The 21 October advisory adds central management software and further risk categories, while the earlier warning remains applicable to its own affected releases and vulnerabilities.
