Read the docs
TI-2026-80283 Aliases CVE-2026-115425GHSA-r7pm-f75m-q6jc

Multiple cross-site scripting in OPNsense firewall

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting vulnerabilities in OPNsense firewall versions through 26.7.1_1 let a low-privileged attacker run JavaScript in the browser of another user. The victim must visit a specific page or click a crafted link. The flaw is classified as CWE-79.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00295 22nd percentileScored 2026-11-07
Fix Fixed OPNsense firewall (OPNsense): 26.7.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opnsenseOPNsense firewallup to 26.7.1_126.7.7Patch availableCNA
  • OPNsense firewall Vendoropnsense Affected up to 26.7.1_1 Fixed in 26.7.7 Patch available CNA

Remediation

OPNsense firewall versions before 26.7.7 are fixed by upgrading to 26.7.7.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA OPNsense firewall (OPNsense) Fixed in 26.7.7

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-115425
  2. 2026-10-26 Weakness changed · CISA ADP
  3. 2026-10-26 CISA SSVC decision points changed
  4. 2026-10-26 Priority changed: MEDIUM → LOW
  5. 2026-10-27 Alias added: GHSA-r7pm-f75m-q6jc

References

Advisory 2

  • TI-2023-20247 A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense… CVSS 3.1CRITICAL 9.8
  • TI-2023-20243 Insecure permissions in the configuration directory (/conf/) of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-20240 A command injection vulnerability in the component diag_backup.php of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-11947 DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers… CVSS 3.1CRITICAL 9.8
  • TI-2026-74819 Path traversal in OPNsense GeoIP importer allows root code execution CVSS 3.1CRITICAL 9.9
  • TI-2023-20246 /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and… CVSS 3.1CRITICAL 9.6
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences