CVE-2026-113810

Deferred Deferred - Pending Action

Stored XSS in SNS Enrollment Portal

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Airbus

Description

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113810

EUVD

EUVD-2026-105257

Affected Vendors & Products

Vendor	Product	Version / Range
Stormshield	Stormshield Network Security	4.8.0
Stormshield	Stormshield Network Security	5.0.0
Stormshield	Stormshield Network Security	5.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the SNS enrollment portal. An attacker can inject malicious scripts when requesting certificate creation for a user. The injected script is stored and only triggered during validation by an administrator.

Detection Guidance

Detection of this Stored Cross-Site Scripting vulnerability requires monitoring network traffic and administrative actions in the SNS enrollment portal. Check for unusual certificate creation requests containing script tags or malicious payloads. Inspect server logs for validation requests that trigger unexpected behavior during administrator review.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of the administrator, or redirect them to malicious sites. This could lead to unauthorized access, data theft, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's security rules. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Update the Stormshield Network Security firmware to the latest version to patch the XSS vulnerability in the SNS enrollment portal.

Hi! I’m here to help you understand CVE-2026-113810. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...