---
id: CVE-2026-113808
title: Stored XSS on SNS Enrollment Portal
summary: >-
  A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment
  Portal.




  Through the captive portal an attacker can inject an XSS when requesting user
  creation. The stored XSS can only be triggered during validation by the adm…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-79
vendor: Stormshield
product: Stormshield Network Security
affected:
  - network_security >= 4.3.0 <= 4.3.44
  - network_security >= 4.8.0 <= 4.8.19
  - network_security >= 5.0.0 <= 5.0.9
  - network_security >= 5.1.0 <= 5.1.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-20T18:47:32.207003Z'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T18:47:45.044Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113808'
references:
  - url: 'https://advisories.stormshield.eu/2026-026/'
tags:
  - cve.org
ingestedAt: '2026-10-20T19:16:14.379Z'
---

## Overview

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.



Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.

## Affected

- `network_security >= 4.3.0 <= 4.3.44`
- `network_security >= 4.8.0 <= 4.8.19`
- `network_security >= 5.0.0 <= 5.0.9`
- `network_security >= 5.1.0 <= 5.1.3`

## Remediation

The following updates will fix this vulnerability:





  *  SNS 5.1.4 EA
  *  SNS 5.0.10
  *  SNS 4.8.20 LSTB
  *  SNS 4.3.45 QS

### Workarounds

There is no workaround solution.