{"id":"CVE-2026-113810","kind":"vulnerability","aliases":["CVE-2026-113810"],"related":[],"title":"SNS enrollment Portal: stored XSS via captive portal certificate request","description":"A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.\n\n\n\nThrough the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.","summary":"Stormshield Network Security's enrollment portal does not sanitize input in captive-portal certificate requests. The stored script runs in the browser of the administrator who validates the request, so an attacker can act with admin rights. Vendor rates it medium, CVSS 7.0 (CNA).","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Stormshield Network Security","fixed":["4.8.20 LTSB","5.0.10","5.1.4 EA"],"affected":">= 4.8.0, <= 4.8.19; >= 5.0.0, <= 5.0.9; >= 5.1.0, <= 5.1.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["captive-portal","firewall","infrastructure","self-hosted","sns","sns-enrollment-portal","stormshield","xss"],"not_affected_if":["captive-portal-disabled","enrollment-not-used","patched-version"],"how_to_check":"In the SNS admin UI (or System > Maintenance), check the firmware version. You are exposed if it is 4.8.0-4.8.19, 5.0.0-5.0.9 or 5.1.0-5.1.3 and the captive portal/enrollment feature is in use.","fix":"Upgrade SNS to 4.8.20 LTSB, 5.0.10 or 5.1.4 EA. The vendor lists no workaround.","status":"open","published_at":"2026-10-20T19:17:34+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:38:19+00:00","updated_at":"2026-10-25T03:39:13+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-25T03:38:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SNS enrollment Portal: stored XSS via captive portal certificate request","impact":"medium","summary":"The SNS enrollment portal does not sanitize input submitted through its captive portal when requesting certificate creation for a user. The injected script is stored and runs in the browser of an administrator who validates the request, letting an attacker act with admin rights.","category":"infrastructure","nicknames":[],"who_cares":["sns-enrollment-portal","captive-portal"],"confidence":0.5,"needs_auth":"no","worst_case":"script runs in administrator's browser, enabling admin session takeover","analyst_note":"Find the vendor and affected versions behind CVE-2026-113810 on the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-113810); sources give no product, version or fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00052,"input_tokens":3298,"output_tokens":381,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor and affected versions behind CVE-2026-113810 on the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-113810); sources give no product, version or fix.","search":"'-113810':13A,16A '-2026':12A,15A '7.0':78B 'act':69B 'admin':71B 'administr':60B,120C 'attack':67B,98C 'browser':57B 'captiv':7A,21B,47B,95C 'captive-port':20B,46B 'certif':9A,49B,105C 'cna':79B 'creation':106C 'cross':83C 'cross-sit':82C 'cve':11A,14A 'cvss':77B 'enrol':2A,31B,39B,91C 'exist':87C 'firewal':23B 'host':27B 'infrastructur':24B 'inject':100C 'input':44B 'medium':76B 'network':18A,36B 'portal':3A,8A,22B,32B,40B,48B,92C,96C 'rate':74B 'request':10A,50B,64B,104C 'right':72B 'run':54B 'sanit':43B 'script':53B,85C 'secur':37B 'security':19A 'self':26B 'self-host':25B 'site':84C 'sns':1A,28B,30B,90C 'sns-enrollment-port':29B 'store':4A,52B,81C,110C 'stormshield':17A,33B,35B 'trigger':115C 'user':108C 'valid':62B,117C 'vendor':73B 'via':6A 'vulner':86C 'xss':5A,34B,102C,111C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-10-25T03:39:13Z","by":"analyst","run_id":762},"products":{"at":"2026-10-25T03:39:13Z","by":"analyst","run_id":762}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T19:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cert@airbus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113810","severity":null,"published_at":"2026-10-20T19:17:34+00:00","modified_at":"2026-10-20T19:35:23+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113810:762","url":null,"severity":null,"published_at":"2026-10-25T03:39:13+00:00","modified_at":"2026-10-25T03:39:13+00:00","first_seen_at":"2026-10-25T03:39:13+00:00","fetched_at":"2026-10-25T03:39:13+00:00","note":"Vendor is Stormshield (SNS); read advisory STORM-2026-027 directly. Affected 4.8.0-4.8.19, 5.0.0-5.0.9, 5.1.0-5.1.3; fixed 4.8.20 LTSB, 5.0.10, 5.1.4 EA; vendor says no workaround. Vendor CVSS temporal lists PoC code maturity but no link and no exploitation reported. Sibling advisory 2026-026 (CVE-2026-113808) also lists 4.3.x, but 027 does not; not claimed. No social search done (low-profile)."}],"documents":[{"id":3267,"url":"https://advisories.stormshield.eu/2026-027/","title":"Stormshield STORM-2026-027: Stored XSS on SNS Enrollment Portal","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3268,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113810","title":"NVD CVE-2026-113810","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}