CVE-2026-111088: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Stormshield Stormshield Network Security

This vulnerability (CVE-2026-111088) is a stored cross-site scripting (CWE-79) issue in Stormshield Network Security's VPN log monitoring screen. It arises from improper input neutralization during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users viewing the logs. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. Affected versions include Stormshield Network Security versions from 4.3.0 through 4.3.44, 4.8.0 through 4.8.19, 5.0.0 through 5.0.9, and 5.1.0 through 5.1.3. No patch or vendor advisory details are provided to confirm remediation status.

The vulnerability allows an attacker with low privileges to inject stored malicious scripts into the VPN log monitoring screen, potentially compromising confidentiality by exposing sensitive information to unauthorized parties. There is no reported impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Stormshield advisories for updates. Until a patch is available, consider restricting access to the VPN log monitoring screen to trusted users only to reduce exposure.