Stormshield Network Security EUVD-2026-105257

Exploitation requires the SNS captive/enrollment portal to be deployed and reachable so an unauthenticated user can submit a certificate-creation request (PR:N), and critically requires an administrator to subsequently open and validate that pending request - the stored payload fires only during this administrator validation step (UI:R). Limiting factors: the attack does not self-trigger and depends on administrator action against the attacker's specific request; attack complexity is high (AC:H); and the portal/enrollment-with-admin-validation workflow must be enabled, so appliances not using captive-portal certificate enrollment are not exposed.

This is a stored XSS (CWE-79) in the Stormshield Network Security (SNS) enrollment/captive portal, rated CVSS 7.0 (High) by the vendor with vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The signals point to a real but gated risk rather than a drop-everything priority. On the pro-risk side: the injection point is reachable by an unauthenticated user of the captive portal (PR:N) and the target is a security appliance, so successful execution runs in the administrator's authenticated management session - hence the vendor's C:H/I:H/A:H. On the mitigating side: AC:H and UI:R mean exploitation is non-trivial and depends entirely on an administrator opening the malicious certificate request to validate it; there is no automatic or self-triggering path. CONFLICT TO VERIFY: the vendor assigns AV:L (local) even though the description says the payload is injected remotely 'through the captive portal,' which is a network-facing component - AV:L appears to model the trigger (admin validating inside the local management context) rather than the delivery. This AV:N-versus-AV:L tension should be verified with Stormshield, as it materially changes exposure. No EPSS score, no CISA KEV listing, and no public POC were provided; exploitation is therefore unproven and likely opportunistic/targeted at best. Overall: a genuine high-severity admin-compromise vector that is meaningfully rate-limited by the required administrator interaction and attack complexity.

An attacker interacting with the Stormshield SNS captive/enrollment portal submits a certificate-creation request containing a malicious script in a user-controlled field. The payload is stored and lies dormant until an administrator opens the request to validate it, at which point the script executes in the administrator's authenticated management session. No public exploit code was identified at time of analysis, and the high attack complexity plus required admin interaction make this a targeted rather than mass-exploitable scenario.