Security Advisories
Hillstone Network Security Advisories
Hillstone Networks Product Security Incident Response Team (PSIRT) is responsible for receiving, assessing, and publicly disclosing security vulnerabilities affecting Hillstone products and services. As the company’s official vulnerability disclosure channel, Hillstone Networks PSIRT is dedicated to protecting customers and partners through responsible disclosure practices and by ensuring compliance with applicable laws and regulations in the management and remediation of product security issues.
Hillstone StoneOS ptf blacklist lib Auto-Download Chain Post-Authentication Root Code Execution Vulnerability
Advisory IDSeverityRelease DateReported ByCVE IDHSVD-2026-0026HighOctober 29, 2026External submissionN/A Overview A post-authentication vulnerability exists in Hillstone StoneOS involving the ptf blacklist lib auto-download chain (requires authenticated administrator...
Hillstone StoneOS logd export Universal Execution Entry Authenticated Root Code Execution Vulnerability
Advisory IDSeverityRelease DateReported ByCVE IDHSVD-2026-0027HighOctober 29, 2026External submissionN/A Overview An authenticated vulnerability exists in Hillstone StoneOS (requires administrator privileges). The log export interface is affected by a command...
Hillstone WAF/ADC Troubleshooting curl IPv6 Host Injection Authenticated Root Code Execution Vulnerability
Advisory IDSeverityRelease DateReported ByCVE IDHSVD-2026-0031HighOctober 29, 2026External submissionN/A Overview The network connectivity test function of the troubleshooting tools in Hillstone WAF, ADC (AX Series) and ADC contains a command injection vulnerability....
Hillstone HSM Front-End Deserialization Remote Command Execution Vulnerability
Advisory IDSeverityRelease DateReported ByCVE IDHSVD-2026-0058HighOctober 23, 2026External submissionN/A Overview A deserialization vulnerability exists in the device management service of the Hillstone HSM (HSM). An unauthenticated remote attacker could exploit this...
Hillstone StoneOS Docker Management Feature Authenticated docker-to-cron Root Code Execution Vulnerability
Advisory IDSeverityRelease DateReported ByCVE IDHSVD-2026-0037HighOctober 23, 2026External submissionN/A Overview An authenticated docker-to-cron root code execution vulnerability exists in the Docker management feature of Hillstone StoneOS. An authenticated...
Hillstone ADC troubleshooting tcpdump SSL keylog Post-Authentication Root Code Execution Vulnerability
Advisory IDSeverityRelease DateReported ByCVE IDHSVD-2026-0023HighSeptember 4, 2026External submissionN/A Overview A command injection vulnerability exists in the backend diagnostic packet capture (tcpdump) interface of the Hillstone ADC. When an authenticated...
Hillstone ADC gslbd_dns exec_refresh Post-Authentication Root Code Execution Vulnerability
Advisory IDSeverityRelease DateReported ByCVE IDHSVD-2026-0024HighSeptember 4, 2026External submissionN/A Overview The GSLB DNS refresh interface of Hillstone ADC contains a post-authentication command execution vulnerability. An authenticated administrator can...
Hillstone HSA Local Command Injection Vulnerability
Advisory IDSeverityRelease DateReported ByCVE IDHSVD-2026-0039MediumSeptember 4, 2026External submissionN/A Overview In the restricted command-line interface (CLI) maintenance tool available after SSH login, the Hillstone HSA fails to adequately sanitize user-supplied...
Hillstone ADC diagnostic_file_export Arbitrary File Download Vulnerability
Advisory IDSeverityRelease DateReported ByCVE IDHSVD-2026-0028MediumSeptember 4, 2026External submissionN/A Overview Hillstone ADC contains an arbitrary file download vulnerability in diagnostic_file_export. It is a backend vulnerability requiring authenticated...
Hillstone WAF wafd_openapi_file YAML Deserialization Authenticated Root Code Execution Vulnerability
Advisory IDSeverityRelease DateReported ByCVE IDHSVD-2026-0036HighSeptember 4, 2026External submissionN/A Overview The OpenAPI file import function of Hillstone WAF is affected by an authenticated root code execution vulnerability. This is a backend vulnerability that...
For the 4th year in a row, Hillstone Networks has been recognized in Gartner Peer Insights Customers’ Choice for Network Firewalls.
The Customers’ Choice is a rating of vendors in a given market — for Hillstone, it’s Network Firewalls — that take into account both the number of reviews and the overall user rating. Based on feedback and ratings from our end users who have purchased, implemented and are happily using our products and services, Hillstone’s overall rating came to 4.9.
