Stormshield Network Security CVE-2026-111088

Exploitation targets the SNS VPN log monitoring screen specifically: an attacker must be able to place a malicious script into data that is persisted into the VPN logs, and an administrator must subsequently open that log monitoring screen in the SNS management interface for the stored payload to execute. Per the CVSS vector, PR:L indicates low-privileged authenticated access is required rather than fully anonymous exploitation. Limiting factors: the payload only fires when a privileged operator views the affected screen (practical user interaction/dependency on admin behavior), access to the management interface is required, and risk is materially reduced where the SNS administration interface is not exposed to untrusted networks.

This is a CWE-79 stored XSS in the VPN log monitoring screen of Stormshield Network Security (SNS) appliances, rated CVSS 6.5 (medium). The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity flaw requiring low privileges, with no user interaction and a high confidentiality impact. However, this vector is internally inconsistent for a stored XSS: such flaws almost always require the victim (an administrator) to render the malicious log entry (implying UI:R) and execute code in the victim's browser context (implying a scope change S:C), and the C:H/I:N/A:N weighting is unusual - XSS typically yields partial confidentiality AND integrity impact (session/token theft plus DOM manipulation) rather than C:H alone. This discrepancy should be verified against the vendor advisory. On exploitation signals: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis - this is not confirmed active exploitation. Net assessment: a legitimate but moderate-priority issue. It is authenticated (PR:L) and depends on an operator viewing a specific admin screen, which bounds real-world risk well below the alarm level a 'C:H' reading alone might suggest. Prioritize patching on internet-exposed management interfaces, but this is not an emergency drop-everything flaw absent evidence of exploitation.

A low-privileged authenticated user (or an actor able to influence VPN log content, e.g. via crafted connection metadata) injects a malicious script payload that is stored and later rendered unsanitized in the SNS VPN log monitoring screen. When an administrator opens that screen, the script executes in the admin's authenticated session, potentially stealing session tokens or performing actions as the administrator. No public exploit code was identified at time of analysis.