CVE-2026-113465: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Stormshield Stormshield Network Security

CVE-2026-113465 is a DOM-based Cross-Site Scripting vulnerability in Stormshield Network Security's web administration panel. The flaw arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts via a crafted URL parameter. Exploitation requires an authenticated administrator to visit the malicious link, enabling script execution within their browser context. The vulnerability affects versions >=5.0.0 <=5.0.9 and >=5.1.0 <=5.1.3. The CVSS 3.1 base score is 6.6 with attack vector 'Adjacent', low attack complexity, no privileges required but user interaction needed, and a scope change with high confidentiality impact but no integrity or availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of the administrator's browser session, potentially compromising confidentiality of sensitive information accessible via the web administration panel. There is no indication of integrity or availability impact. The attack requires user interaction (the administrator clicking a malicious link) and can be performed remotely from an adjacent network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious or untrusted links and consider restricting access to the web administration panel to trusted networks only.