Medium severity · published Oct 15, 2026
CVE-2026-58394
OPNsense: Stored XSS in Administration Settings via Certificate Description
5.2
CVSS
0.2%
EPSS
No
On KEV
Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · opnsense
< 26.1.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58394
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58394
github.com
https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb
github.com
https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674
github.com
https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j
hackerask.com
https://hackerask.com/posts/opnsense
More from core
9.9
CVE-2026-57155
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
9.1
CVE-2026-45158
OPNsense: Command Injection via Attacker-Controlled DHCP Config
9.1
CVE-2026-44194
OPNsense: RCE on user managment
9.1
CVE-2026-44193
OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method
9.0
CVE-2026-53581
ntp: write path traversal