CVE-2026-113810: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Stormshield Stormshield Network Security

This vulnerability (CVE-2026-113810) involves improper neutralization of input during web page generation (CWE-79) in the SNS enrollment portal of Stormshield Network Security. An attacker can inject stored XSS payloads via the captive portal during certificate creation requests. The malicious script is stored and executed when an administrator validates the request, potentially leading to high impact including confidentiality, integrity, and availability compromise. The vulnerability affects versions >=4.8.0 <=4.8.19, >=5.0.0 <=5.0.9, and >=5.1.0 <=5.1.3.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the administrator's browser during validation. This can lead to full compromise of confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector (C:H/I:H/A:H). The attack requires local access vector with high attack complexity and no privileges but user interaction is required.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the enrollment portal and limit administrator interactions with untrusted certificate requests to reduce risk.