CVE-2026-14466

MediumCVSS 4.3

Published: 04/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface.

Risk Assessment

The risk is the potential for persistent malicious script execution in the admin panel, which could lead to administrator session hijacking or other attacks. However, it requires administrator privileges.

Recommendation

It is recommended to upgrade Stormshield to a version that includes XSS fixes. Also, restrict administrator privileges and regularly review group comments for malicious content.

Other vulnerabilities in Stormshield

CVE-2026-113465Medium
A DOM-based Cross-Site Scripting attack is possible against Stormshield's web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS