CVE-2026-8474CWE-79

Possible to run a Cross Site Scripting request on the login API available on Stormshield SNS appliances.

Medium · published June 1, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

A vulnerability was discovered on Stormshield Network Security

* 4.3.0 to 4.3.41,

* 4.8.0 to 4.8.15,

* 5.0.0 to 5.0.5

It is possible to execute a reflected XSS attack on the login API available on Stormshield SNS appliance by executing a script on the victim's machine. The risks include the theft of cookies or other sensitive data, as well as the modification of page behavior, for example, by redirecting the victim to malicious websites.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-01T07:47Z
EPSS history
Timeline
  • 01 JUN 07:47Z
    Possible to run a Cross Site Scripting request on the login API available on Stormshield SNS appliances.
    cvelistv5