Stormshield Network Security CVE-2026-14466

Exploitation requires an active SNS administrator account with write permissions specifically to group objects in the webservices administration interface (PR:H). A separate, second administrator must subsequently open the poisoned group entry in their browser session (UI:R), triggering execution. Adjacent network access to the SNS web administration panel is required (AV:A) - typically a management VLAN or direct LAN segment. No non-default configuration is needed beyond normal use of group comments; however, the dual-admin requirement and the adjacent-only network constraint together meaningfully limit opportunistic or remote unauthenticated exploitation. Exploitation is further bounded by the requirement that at least one administrator hold group-write permissions, limiting exposure in environments with tightly scoped RBAC.

The CVSS 4.3 base score accurately captures the compounded constraints: high privilege required (PR:H) to write the payload, adjacent network scope (AV:A), and mandatory user interaction by a victim administrator (UI:R). Real-world impact pivots entirely on a dual-admin scenario - a rogue or compromised admin plants the payload, and a second admin session triggers it. The C:H rating reflects that successful XSS in an admin session can exfiltrate session cookies or tokens, potentially enabling full session hijack on a security appliance - a high-value pivot point. With no EPSS data provided, likelihood must be inferred from attack complexity: the preconditions substantially reduce opportunistic exploitation risk, and the absence of both KEV listing and public exploit code reinforces a low probability of widespread campaigns. The scenario most relevant is insider threat or post-compromise lateral movement; even a small administrative team managing SNS appliances would face this risk profile, but the high privilege bar means this is not a spray-and-pray vulnerability.

A rogue or compromised SNS administrator with group-edit permissions navigates to the webservices administration interface and saves a JavaScript cookie-exfiltration payload inside a group comment field. When a second administrator with a live session opens that group entry for review, the payload executes in their browser, transmitting the session token to an attacker-controlled endpoint. The attacker replays the captured token to assume full administrative control of the firewall management console, no further credentials required.