CVE-2026-115425: Multiple cross-site scripting (XSS) in OPNsense

Q: Who can exploit these vulnerabilities?

A low-privileged attacker can exploit them. Successful exploitation requires another user to visit a specific page or click a specially crafted link.

Q: Which installations are affected?

OPNsense firewall version 26.7.1_1 and earlier is affected.

Published Oct 26, 2026

Updated

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.11 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.

Affected Software

1 affected component

OPNsense OPNsense<=26.7.1_1

Event History

Oct 26, 2026

CVE Published

via MITRE·08:10 AM

Data Sourced

via MITRE·08:10 AM

Description

Frequently Asked Questions

Who can exploit these vulnerabilities?

A low-privileged attacker can exploit them. Successful exploitation requires another user to visit a specific page or click a specially crafted link.

Which installations are affected?

OPNsense firewall version 26.7.1_1 and earlier is affected.

CVE-2026-115425: Multiple cross-site scripting (XSS) in OPNsense

Affected Software

Event History

Frequently Asked Questions

Who can exploit these vulnerabilities?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit these vulnerabilities?

Which installations are affected?