CVE-2026-44193

Critical

Published: 13/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

OPNsense is a FreeBSD based firewall and routing platform. In versions prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input, leading to Remote Code Execution.

Risk Assessment

This vulnerability could allow attackers to execute code remotely on the server, posing a serious threat to the security of the system and the organization's data.

Recommendation

It is recommended to update OPNsense to version 26.1.7 or later to mitigate this vulnerability.

Original NVD description (English source)

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.