Stormshield Network Security EUVD-2026-104832

Exploitation requires that an authenticated administrator of the Stormshield Network Security web administration panel be socially engineered into visiting an attacker-crafted URL that places a malicious script payload into a specific request parameter processed by a client-side DOM sink; the payload then executes in the admin's browser within their authenticated session. Key limiting factors: the victim must be a currently-authenticated administrator (not an anonymous user), active user interaction is mandatory (UI:R - clicking the crafted link), delivery depends on phishing/link-luring, and access is adjacent (AV:A) rather than fully remote, consistent with management interfaces that are typically restricted to a management network segment. No impact to integrity or availability is claimed in the vector (I:N/A:N), limiting the flaw to confidentiality/session exposure.

This is a medium-severity (CVSS 6.6) DOM-based XSS confined by several real-world limiting factors, and the available signals point to a moderate rather than urgent priority. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N indicates an adjacent-network attack (AV:A), low complexity, and no attacker-side privileges (PR:N) - but it also requires user interaction (UI:R), and the description makes clear that interaction must come from an already-authenticated administrator who is lured into clicking a crafted URL. There is an important nuance to flag explicitly: PR:N reflects that the ATTACKER needs no privileges, yet successful exploitation still depends on an authenticated admin victim, so this is not a fully unauthenticated-to-impact path. No EPSS score, SSVC decision data, KEV listing, or POC indicator was provided in the input, so exploitation probability cannot be quantified - the absence of EPSS/KEV is a data gap, not evidence of safety. Exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a credible but social-engineering-dependent flaw in a security-management plane; prioritize patching because the target is a firewall admin panel (high-value), but it is not a drive-by mass-exploitation risk.

An attacker with adjacent access to the management network crafts a URL embedding a malicious script in a specific vulnerable parameter of the Stormshield web administration panel, then uses phishing or a planted link to lure an authenticated administrator into opening it. When the admin (already logged in) visits the link, the DOM-based sink executes the attacker's script in the context of the admin session, enabling session/config data theft or administrative actions. No public exploit code was identified in the provided data.