CVE-2026-58394
MEDIUM 5.2OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 15th percentile
Impact if exploited
5.2CVSS 3.1 · MEDIUM
- ConfidentialityHigh
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires an admin / high-privilege account
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-79: : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
References and research data (JSON)
All CVSS metrics
- MEDIUM 5.2 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N - MEDIUM 5.2 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j CVE record · GitHub_M · Updated 2026-10-15T15:20:15.232Z
CVE record · CISA-ADP · Updated 2026-10-15T18:36:57.734Z
NVD · CVE-2026-58394 · Updated 2026-10-15T21:08:49.703
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102135 EUVD · EUVD-2026-102135
Technical & other
- https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb CVE record · GitHub_M · Updated 2026-10-15T15:20:15.232Z
NVD · CVE-2026-58394 · Updated 2026-10-15T21:08:49.703 - https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674 CVE record · GitHub_M · Updated 2026-10-15T15:20:15.232Z
NVD · CVE-2026-58394 · Updated 2026-10-15T21:08:49.703 - https://hackerask.com/posts/opnsense CVE record · GitHub_M · Updated 2026-10-15T15:20:15.232Z
NVD · CVE-2026-58394 · Updated 2026-10-15T21:08:49.703