Stored Cross-Site Scripting Vulnerability in SNS Enrollment Portal by Stormshield
CVE-2026-113810

7HIGH

Key Information:

Vendor

Stormshield

Status
Stormshield Network Security
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113810?

A Stored Cross-Site Scripting (XSS) vulnerability exists in the SNS Enrollment Portal offered by Stormshield. This flaw allows an attacker to inject malicious scripts through the captive portal when requesting the creation of a certificate for a user. The malicious script remains in the system and can be executed when the affected data is validated by an administrator, posing significant risks to user data and application integrity.

Affected Version(s)

Stormshield Network Security 4.8.0 <= 4.8.19

Stormshield Network Security 5.0.0 <= 5.0.9

Stormshield Network Security 5.1.0 <= 5.1.3

References

https://advisories.stormshield.eu/2026-027/

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.