Reflected XSS Vulnerability in Stormshield Network Security Appliances
CVE-2026-8474

5.3MEDIUM

Key Information:

Vendor

Stormshield

Status
Stormshield Network Security
Vendor
CVE Published:
1 June 2026

What is CVE-2026-8474?

A reflected XSS vulnerability exists within the login API of Stormshield Network Security appliances. This vulnerability allows malicious actors to execute scripts on a victim's machine, potentially leading to unauthorized access to sensitive information such as cookies. Furthermore, attackers can manipulate page behaviors, including redirecting victims to harmful websites, posing significant risks to user security and data integrity.

Affected Version(s)

StormShield Network Security 4.3.0 <= 4.3.41

StormShield Network Security 4.8.0 <= 4.8.15

StormShield Network Security 5.0.0 <= 5.0.5

References

https://advisories.stormshield.eu/2026-003/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.