CVE-2026-14466 - Vulnerability Details - OpenCVE

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Stormshield	Stormshield Network Security

No data.

No data.

References

Link	Providers
https://advisories.stormshield.eu/2026-006

History

Fri, 04 Sep 2026 15:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Stormshield Stormshield stormshield Network Security
Vendors & Products		Stormshield Stormshield stormshield Network Security

Fri, 04 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 04 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface.
Title		Possible XSS in the SNS web administration panel
Weaknesses		CWE-79
References		https://advisories.stormshield.eu/2026-006
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: airbus

Published: 2026-09-04T14:27:58.190Z

Updated: 2026-09-04T14:41:07.268Z

Reserved: 2026-07-02T12:42:10.025Z

Link: CVE-2026-14466

Vulnrichment

Updated: 2026-09-04T14:40:59.135Z

NVD

Status : Deferred

Published: 2026-09-04T15:17:32.540

Modified: 2026-09-08T14:03:48.663

Link: CVE-2026-14466

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14466", "assignerOrgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "state": "PUBLISHED", "assignerShortName": "airbus", "dateReserved": "2026-07-02T12:42:10.025Z", "datePublished": "2026-09-04T14:27:58.190Z", "dateUpdated": "2026-09-04T14:41:07.268Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "shortName": "airbus", "dateUpdated": "2026-09-04T14:32:28.756Z"}, "title": "Possible XSS in the SNS web administration panel", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "affected": [{"vendor": "Stormshield", "product": "Stormshield Network Security", "versions": [{"status": "affected", "version": "4.8.0", "lessThanOrEqual": "4.8.16", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThanOrEqual": "5.0.6", "versionType": "semver"}, {"status": "unaffected", "version": "4.8.17", "versionType": "semver"}, {"status": "unaffected", "version": "5.0.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.1.0", "versionType": "semver"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "It\u2019s possible to run a stored XSS in Stormshield\u2019s web administration panel.\n\n\n\nTo exploit this vulnerability, a SNS administrator with appropriate permissions must inject\u00a0 some malicious script in a group\u2019s comments in the webservices administration interface.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>It\u2019s possible to run a stored XSS in Stormshield\u2019s web administration panel.</p><p>To exploit this vulnerability, a SNS administrator with appropriate permissions must inject  some malicious script in a group\u2019s comments in the webservices administration interface.</p>"}]}], "references": [{"url": "https://advisories.stormshield.eu/2026-006"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "The following updates will fix this vulnerability:\n\n * SNS 5.1.0\n * SNS 5.0.7\n * SNS 4.8.17", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The following updates will fix this vulnerability:</p><ul><li>SNS 5.1.0</li><li>SNS 5.0.7</li><li>SNS 4.8.17</li></ul>"}]}], "credits": [{"lang": "en", "value": "We acknowledge the researcher Supr4s for discovering this vulnerability.", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-04T14:40:47.477086Z", "id": "CVE-2026-14466", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-04T14:41:07.268Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-14466", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-04T14:40:47.477086Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-04T14:40:59.135Z"}}], "cna": {"title": "Possible XSS in the SNS web administration panel", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "We acknowledge the researcher Supr4s for discovering this vulnerability."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Stormshield", "product": "Stormshield Network Security", "versions": [{"status": "affected", "version": "4.8.0", "versionType": "semver", "lessThanOrEqual": "4.8.16"}, {"status": "affected", "version": "5.0.0", "versionType": "semver", "lessThanOrEqual": "5.0.6"}, {"status": "unaffected", "version": "4.8.17", "versionType": "semver"}, {"status": "unaffected", "version": "5.0.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.1.0", "versionType": "semver"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "The following updates will fix this vulnerability:\n\n * SNS 5.1.0\n * SNS 5.0.7\n * SNS 4.8.17", "supportingMedia": [{"type": "text/html", "value": "<p>The following updates will fix this vulnerability:</p><ul><li>SNS 5.1.0</li><li>SNS 5.0.7</li><li>SNS 4.8.17</li></ul>", "base64": false}]}], "references": [{"url": "https://advisories.stormshield.eu/2026-006"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "It\u2019s possible to run a stored XSS in Stormshield\u2019s web administration panel.\n\n\n\nTo exploit this vulnerability, a SNS administrator with appropriate permissions must inject\u00a0 some malicious script in a group\u2019s comments in the webservices administration interface.", "supportingMedia": [{"type": "text/html", "value": "<p>It\u2019s possible to run a stored XSS in Stormshield\u2019s web administration panel.</p><p>To exploit this vulnerability, a SNS administrator with appropriate permissions must inject  some malicious script in a group\u2019s comments in the webservices administration interface.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "shortName": "airbus", "dateUpdated": "2026-09-04T14:32:28.756Z"}}}, "cveMetadata": {"cveId": "CVE-2026-14466", "state": "PUBLISHED", "dateUpdated": "2026-09-04T14:41:07.268Z", "dateReserved": "2026-07-02T12:42:10.025Z", "assignerOrgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "datePublished": "2026-09-04T14:27:58.190Z", "assignerShortName": "airbus"}, "dataVersion": "5.2"}