CVE-2026-14466

published 2026-09-04

CVE-2026-14466: It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions…

Priority P4 20 medium 4.3 CVSS 3.1

AV A AC L PR H UI R S U C H I N A N

It’s possible to run a stored XSS in Stormshield’s web administration panel.

To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
stormshield	stormshield_network_security	4.8.0 – 4.8.16	—
stormshield	stormshield_network_security	5.0.0 – 5.0.6	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79