Medium severity · published Oct 26, 2026
CVE-2026-115425
Multiple cross-site scripting (XSS) in OPNsense
New
5.6
CVSS
0.3%
EPSS
No
On KEV
Description
Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
OPNsense firewall · OPNsense
through 26.7.1_1 · source: vendor