Description
Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.
Published: 2026-10-26
Score: 5.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑site scripting via browser JavaScript injection
Action: Patch Immediately
AI Analysis

Impact

Multiple cross‑site scripting vulnerabilities affect OPNsense firewall versions 26.7.1_1 and earlier. An attacker with only low privileges can craft a page or link that, when visited by another user, causes arbitrary JavaScript to run within that user’s browser context. This allows execution of harmful scripts that could harvest credentials, hijack sessions, or otherwise compromise the visiting user’s confidentiality and integrity.

Affected Systems

OPNsense firewall, versions 26.7.1_1 and earlier

Risk and Exploitability

The CVSS score of 5.6 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can likely reach the vulnerable input through the web interface of OPNsense; low‑privileged users can create the crafted link or page, while the victim visits it. The attack relies on client‑side execution of JavaScript injected via the vulnerable input endpoint, and it does not require administrative credentials on the firewall.

Generated by OpenCVE AI on October 26, 2026 at 09:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a version of OPNsense that includes the XSS fixes (any release newer than 26.7.1_1).
  • If an immediate update is not possible, restrict access to the affected web pages or disable the UI components that process the vulnerable input until the patch is applied.
  • Apply a web application firewall or content‑security‑policy rules that block execution of unsanitized JavaScript to mitigate the risk of XSS until the vendor releases a patch.

Generated by OpenCVE AI on October 26, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Opnsense
Opnsense opnsense Firewall
Vendors & Products Opnsense
Opnsense opnsense Firewall

Mon, 26 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79

Mon, 26 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Description Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.
Title Multiple cross-site scripting (XSS) in OPNsense
References
Metrics cvssV4_0

{'score': 5.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/S:P/AU:Y/R:I/V:C/RE:M/U:Amber'}

Subscriptions

Opnsense Opnsense Firewall
cve-icon MITRE

Status: PUBLISHED

Assigner: NCSC.ch

Published:

Updated: 2026-10-26T14:24:20.876Z

Reserved: 2026-10-22T13:40:10.572Z

Link: CVE-2026-115425

cve-icon Vulnrichment

Updated: 2026-10-26T14:23:11.926Z

cve-icon NVD

Status : Deferred

Published: 2026-10-26T09:16:34.620

Modified: 2026-10-26T15:16:38.770

Link: CVE-2026-115425

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T18:51:27Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')