Get real-time updates on Telegram
CVE-2026-49131: OPNsense 0 to before 26.1.9
CVE-2026-49131. CVSS 3.1 base score 5.4 (MEDIUM, Vendor/CNA). EPSS 0.00289 (percentile 0.20301), scored 22-Oct-2026.
Affected technology
OPNsense · 0 to before 26.1.9
Deciso B.V.
Description’s affected range: before 26.1.9
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction
What an attacker can do
Authenticated attackers with firewall rule management privileges can inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality, integrity and availability impact as none.
- CWE
- CWE-79
- CCR priority
- 21.7 /100 (P4)
- CVSS 3.1
- 5.4 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · Vendor/CNA
- EPSS
- 0.00289 · percentile 0.20301 · 2026-10-22
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-24 01:40:49.068977+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-49131.html