PT-2026-40826 · Opnsense · Opnsense

Published 2026-05-13 · Updated 2026-05-14 · CVE-2026-44193

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.7

Description OPNsense is a FreeBSD based firewall and routing platform. The XMLRPC method 'opnsense.restore config section' fails to sanitize user supplied input, which can lead to Remote Code Execution (RCE), a process where an attacker can execute arbitrary commands on the target machine.

Recommendations Update to version 26.1.7.

Exploit

Fix

RCE

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-44193

Affected Products

Opnsense

References · 4

• 🔥 https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44193 · Security Note
• https://t.me/CVEtracker/53708 · Telegram Post
• https://twitter.com/CVEnew/status/2054709183560470641 · Twitter Post