---
id: "CVE-2026-113810"
kind: "vulnerability"
aliases: ["CVE-2026-113810"]
title: "SNS enrollment Portal: stored XSS via captive portal certificate request"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Stormshield Network Security", "fixed": ["4.8.20 LTSB", "5.0.10", "5.1.4 EA"], "affected": ">= 4.8.0, <= 4.8.19; >= 5.0.0, <= 5.0.9; >= 5.1.0, <= 5.1.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["captive-portal", "firewall", "infrastructure", "self-hosted", "sns", "sns-enrollment-portal", "stormshield", "xss"]
not_affected_if: ["captive-portal-disabled", "enrollment-not-used", "patched-version"]
published_at: "2026-10-20T19:17:34+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:39:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113810", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:39:13+00:00"}]
---

# SNS enrollment Portal: stored XSS via captive portal certificate request

Stormshield Network Security's enrollment portal does not sanitize input in captive-portal certificate requests. The stored script runs in the browser of the administrator who validates the request, so an attacker can act with admin rights. Vendor rates it medium, CVSS 7.0 (CNA).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Stormshield Network Security affected >= 4.8.0, <= 4.8.19; >= 5.0.0, <= 5.0.9; >= 5.1.0, <= 5.1.3 fixed 4.8.20 LTSB, 5.0.10, 5.1.4 EA

## How to check

In the SNS admin UI (or System > Maintenance), check the firmware version. You are exposed if it is 4.8.0-4.8.19, 5.0.0-5.0.9 or 5.1.0-5.1.3 and the captive portal/enrollment feature is in use.

## Fix

Upgrade SNS to 4.8.20 LTSB, 5.0.10 or 5.1.4 EA. The vendor lists no workaround.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113810
- 2026-10-25T03:39:13+00:00 analyst — Vendor is Stormshield (SNS); read advisory STORM-2026-027 directly. Affected 4.8.0-4.8.19, 5.0.0-5.0.9, 5.1.0-5.1.3; fixed 4.8.20 LTSB, 5.0.10, 5.1.4 EA; vendor says no workaround. Vendor CVSS temporal lists PoC code maturity but no link and no exploitation reported. Sibling advisory 2026-026 (CVE-2026-113808) also lists 4.3.x, but 027 does not; not claimed. No social search done (low-profile).

## Documents

- [advisory] Stormshield STORM-2026-027: Stored XSS on SNS Enrollment Portal https://advisories.stormshield.eu/2026-027/
- [mentions] NVD CVE-2026-113810 https://nvd.nist.gov/vuln/detail/CVE-2026-113810

## From the sources

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.



Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_