CVE-2026-8482

MediumCVSS 4.3/10Last modified Jul 2, 2026

Description

A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included)

There is a possible leak of secret information if administration commands have been passed with the CLI command line tool.

Someone with SSH access to the firewall (if SSH multiuser mode is enabled) could possibly get the proxy CA passphrase or TPM password.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Jul 2, 2026
Last modified
Jul 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-848207.1Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.CVE-2026-848217.5Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.CVE-2026-848237.1A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploitCVE-2026-848286.5A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs hostCVE-2026-848298.8The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute,CVE-2026-848308.6SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute cCVE-2026-848317.7SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is comCVE-2026-848328.6SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate valiCVE-2026-848334.3A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknoCVE-2026-848349.8Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.CVE-2026-848355.3Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.CVE-2026-848367.1Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.
CVE-2026-8482: Medium severity, CVSS 4.3 | Vulnix