Stormshield Network Security CVE-2026-113808

Exploitation requires that the SNS captive/enrollment portal be enabled and configured to accept user self-enrollment (user-creation) requests, and that administrators manually validate those requests through the management interface - the stored payload is dormant until that validation step. Limiting factors: the attacker must be on the adjacent network with reach to the portal (AV:A, not Internet-wide); exploitation is gated on a required administrator action (UI:R) and is of high attack complexity (AC:H), meaning it cannot be automated or triggered without a privileged human opening the malicious enrollment record. No prior authentication is needed to submit the request (PR:N).

The vendor-assigned CVSS 3.1 score of 7.1 (High) overstates the practical urgency once the vector is decomposed. AV:A confines the attacker to the adjacent network (the captive/enrollment portal network segment) rather than the open Internet, AC:H signals a non-trivial, condition-dependent exploit, and critically UI:R means the stored payload only fires when an administrator manually validates the malicious enrollment request - exploitation cannot proceed without a human admin action. PR:N confirms the attacker needs no prior authentication to submit the request, which is the one factor raising the risk. No EPSS probability, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active or imminent widespread exploitation (no public exploit identified at time of analysis). The signals are internally consistent - a hard-to-automate, interaction-gated, adjacent-network flaw - which points to a real but conditional, targeted-style risk rather than a mass-exploitation priority. The C:H/I:H/A:H impact rating assigned by the vendor is aggressive for a stored XSS and should be verified; XSS executing in an admin browser plausibly yields high confidentiality/integrity impact but direct availability impact (A:H) is questionable and warrants confirmation with Stormshield.

An unauthenticated attacker with access to the captive/enrollment portal network submits a user-creation (enrollment) request containing a crafted XSS payload in a user-controlled field. The payload is stored and lies dormant until an administrator opens the enrollment validation interface to approve the request, at which point the script executes in the administrator's authenticated session. No public exploit code was identified at time of analysis.