CVE-2026-44193

EUVD-2026-30183
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.
Argument Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
Affected Products (NVD)
VendorProductVersion
opnsenseopnsense
𝑥
< 26.1.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p
https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p