[ CVE-2026-113808 · Published 20 Oct 2026 ]
Vulnerability in Stormshield Network Security
CVSS 7.1
EPSS <1%1 agency advisoryNo fix listed yet
[ Description ]Official description
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1345
Multiple vulnerabilities in StormShield products Translated from French
Multiple vulnerabilities have been discovered in StormShield products. Some of them allow an attacker to cause arbitrary code execution, remote denial of service and a breach of data confidentiality.