CVE-2026-14466: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Stormshield Stormshield Network Security

This vulnerability (CVE-2026-14466) involves improper neutralization of input during web page generation (CWE-79) in Stormshield Network Security's web administration panel. Specifically, a stored XSS can be executed by an SNS administrator who injects malicious script code into group comments in the webservices administration interface. The vulnerability requires administrator-level privileges and user interaction (UI:R). The CVSS vector indicates the attack is possible over an adjacent network (AV:A) with low attack complexity (AC:L) and high privileges (PR:H). The impact includes high confidentiality impact (C:H) but no integrity or availability impact.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary scripts within the web administration panel context, potentially leading to unauthorized disclosure of sensitive information. There is no indication of integrity or availability impact. The vulnerability requires an authenticated administrator to inject the malicious payload, limiting the attack surface.

No official patch or remediation level is currently provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity in group comments within the webservices administration interface.