CVE-2026-113465: Stormshield Network Security DOM-based XSS in web administration panel

CVE-2026-113465 · Severity: medium · CVSS 6.6 · Published 2026-10-20

Stormshield Network Security (SNS) is a network appliance that manages enterprise network security. A DOM-based cross-site scripting vulnerability in its web administration panel could allow an attacker to steal an authenticated administrator's session or credentials if the admin visits a malicious link. No workaround is available; the appliance must be upgraded to fix the issue.

Technologies: Stormshield Network Security. Vendors: Stormshield.

Quick answers

Is CVE-2026-113465 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-113465 being exploited in the wild.
How severe is CVE-2026-113465?
Medium severity, with a CVSS score of 6.6, published 20 October 2026.
Which products and versions are affected?
Stormshield Network Security 5.0.0 to 5.0.9, 5.1.0 to 5.1.3.
Is there a fix for CVE-2026-113465?
Yes: fixed in SNS 5.0.10, SNS 5.1.4 EA. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113465 attacked?
It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-113465?
Check whether you run Stormshield Network Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: SNS 5.0.10, SNS 5.1.4 EA

Technical details

A DOM-based XSS vulnerability exists in the SNS web administration panel where user input is reflected in a URL parameter and executed as JavaScript. The attack requires an authenticated administrator to click a crafted link, but does not require administrator privileges to create the link. The vulnerability could enable session hijacking or credential theft through cookie/token exfiltration.

Affected products

  • Stormshield Network Security 5.0.0 to 5.0.9, 5.1.0 to 5.1.3

Timeline

  • 2026-10-20: disclosed
  • 2026-10-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.