Medium 5.6Published Oct 26, 2026

CVE-2026-115425Multiple cross-site scripting (XSS) in OPNsense

Updated under an hour ago (Oct 28, 2026, 3:40 PM ET)

Does this affect you?

It affects OPNsense firewall. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for OPNsense firewall

Exploited in the last 30 days

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.

CVSS: 5.6 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/S:P/AU:Y/R:I/V:C/RE:M/U:Amber
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: NCSC.ch
NVD analysis: Deferred
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 26, 2026

Affected products

Affected products

OPNsense OPNsense firewall opnsense:firewall (from the name)	through 26.7.1_1; 26.7.7 not affected	CNA record

References

References

https://digitalcanion.com/security-research/#ghsa-9h93-hhcx-957c	third-party-advisory
https://github.com/opnsense/core/security/advisories/GHSA-9h93-hhcx-957c	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.