CVE-2026-113465

MediumCVSS 6.6

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

A DOM-based Cross-Site Scripting attack is possible against Stormshield's web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

Risk Assessment

This vulnerability could allow execution of arbitrary JavaScript in the context of an administrator's session, potentially leading to takeover of the administration panel.

Recommendation

Update Stormshield software to a patched version and inform administrators about the risk of clicking on unknown links.

Other vulnerabilities in Stormshield

CVE-2026-14466Medium
It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface.

Original NVD description (English source)

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS