Live › vulnerability › CVE-2026-115425
Go to dashboardSeveral cross-site scripting flaws in OPNsense firewall version 26.7.1_1 and earlier let a low-privileged user inject JavaScript. When another user visits a crafted page or clicks a crafted link, that script runs in their browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 09:29 UTC. All times on this page are UTC.
Any OPNsense firewall running version 26.7.1_1 or earlier is potentially exposed, especially where several users with different privilege levels use the web interface. Exposure depends on users being lured into visiting a crafted page while logged in, so teams with a single administrator on a locked-down management network have less immediate risk. Installations already on a later release are not affected.
No product ranges from the sources yet.
opnsense-version on the firewall (or check System > Firmware > Status) and compare against 26.7.1_126.7.1_1; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.
This page as .md · .json · in your agent: get_signal("CVE-2026-115425")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.