Possible XSS in the SNS web administration panel

Advisory ID CVE Number Date discovered Severity Advisory revision
STORM-2026-006 CVE-2026-14466 12/17/2025 medium v2

Vulnerability details

A vulnerability  has been identified in Stormshield’s web administration panel, affecting SNS appliances.

Impacted products

ProductsSeverityDetail
Stormshield Network Security medium SNS is impacted.

Revisions

Version Date Description
v1 04/03/2026 Initial release
v2 09/04/2026 Updated and disclosed


Stormshield Network Security

CVSS v3.1 Overall Score: 5.3      

Analysis

Impacted version

It’s possible to run a stored XSS in Stormshield’s web administration panel.

To exploit this vulnerability, a SNS administrator with appropriate permissions must inject  some malicious script in a group’s comments in the webservices administration interface.
  • SNS 5.0.0 to 5.0.6
  • SNS 4.8.0 to 4.8.16

Workaround solution

Solution

There is no workaround solution.

The following updates will fix this vulnerability:

  • SNS 5.1.0
  • SNS 5.0.7
  • SNS 4.8.17


Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability impact
Adjacent Network Low High Required Unchanged High None None
CVSS Base score: 4.3 CVSS Vector: (AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N)
Exploit Code Maturity Remediation Level Report Confidence
Unproven that exploit exists Official fix Confirmed
CVSS Temporal score: 3.8 CVSS Vector: (AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Attack Vector (MAV) Attack Complexity (MAC) Privileges Required (MPR) User Interaction (MUI) Scope (MS)
Adjacent Network Low High Required Unchanged
Confidentiality Impact (MC) Integrity Impact (MI) Availability Impact (MA)
High None None
Confidentiality Requirement (CR) Integrity Requirement (IR) Availability Requirement (AR)
High Low Low
CVSS Environmental score: 5.3 CVSS Vector: (AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C/CR:H/IR:L/AR:L/MAV:A/MAC:L/MPR:H/MUI:R/MS:U/MC:H/MI:N/MA:N)


Acknowledgements

We acknowledge the researcher Supr4s for discovering this vulnerability.