CVE-2026-113810
7.0HighPublished 20 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-79
Impact
Attackers can execute malicious scripts in an administrator's browser session when the admin validates user certificate requests. The attacker requires captive portal access to submit the malicious certificate enrollment request, and the admin must view the request to trigger the payload.
Root cause
The SNS enrollment Portal fails to sanitize user-supplied input during captive portal certificate enrollment requests before rendering it in the admin validation interface.
Affected systems
Stormshield Network Security (SNS) enrollment portal; specific versions are not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Stormshield Network Security to the patched release referenced in vendor advisory 2026-027, or restrict captive portal enrollment access to trusted networks until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.