CVE-2026-113808: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Stormshield Stormshield Network Security

This vulnerability is a stored XSS (CWE-79) in the SNS enrollment portal of Stormshield Network Security. Attackers can inject malicious scripts when requesting user creation via the captive portal. The injected script is stored and executed later during administrator validation, potentially compromising confidentiality, integrity, and availability. The vulnerability affects versions >=4.3.0 <=4.3.44, >=4.8.0 <=4.8.19, >=5.0.0 <=5.0.9, and >=5.1.0 <=5.1.3. No vendor advisory or patch information is provided in the input data.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the administrator's browser during validation, leading to high impact on confidentiality, integrity, and availability of the system. This could result in unauthorized actions or data exposure within the administrative interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the enrollment portal and ensure administrators are cautious when validating user creation requests to mitigate the risk of XSS exploitation.