CVE-2026-113810: Stored XSS on SNS Enrollment Portal

Published Oct 20, 2026

Updated

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.

Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.

Affected Software

1 affected component

SNS Enrollment Portal

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SNS to a version that resolves this vulnerability.
Fixed in 4.8.20 LTSB
Upgrade
Upgrade SNS to a version that resolves this vulnerability.
Fixed in 5.0.10
Upgrade
Upgrade SNS to a version that resolves this vulnerability.
Fixed in 5.1.4 EA

Event History

Oct 20, 2026

CVE Published

via MITRE·06:31 PM

Data Sourced

via MITRE·06:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is most directly exposed to the impact of this issue?

Administrators are exposed when they validate certificate creation requests, because that validation step triggers the stored script.

What does an attacker need to do to exploit the issue?

The attacker must use the captive portal to submit a certificate creation request containing an injected script. Exploitation also depends on an administrator later validating that request.