CVE-2026-115425— Multiple cross-site scripting (XSS) in OPNsense

Quick assessment

Affected

OPNsense OPNsense firewall

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OPNsense 防火墙 26.7.1_1 及更早版本存在多个跨站脚本（XSS）漏洞，允许低权限攻击者在其他用户访问特定页面或点击经过精心构造的链接时，以该用户的上下文执行 JavaScript 代码。

CVSS 5.6 · Medium EPSS 0.29% · P22 Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1055.001 · Dynamic-link Library Injection T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
OPNsense	OPNsense firewall	`≤ 26.7.1_1`	affected
		`26.7.7`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Multiple cross-site scripting (XSS) in OPNsense

Source: CVE Program / CVE List V5

Vulnerability Description

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/S:P/AU:Y/R:I/V:C/RE:M/U:Amber

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
OPNsense	OPNsense firewall	0 ~ 26.7.1_1	-

II. Public POCs for CVE-2026-115425

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115425

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-115425 (1)

🔗 Multiple cross-site scripting (XSS) in OPNsense 26.7.1_1 Architecture amd64 08d6a7847 · Advisory · opnsense/core · GitHub vendor-advisory

Security Blog Posts for CVE-2026-115425 (1)

🔗 Security Research : recherche de failles | DigitalCanion SA Read full article third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-115425

IV. Related Vulnerabilities

Same vendor: OPNsense