CVE-2026-44194
CriticalSummary
In OPNsense, prior to version 26.1.8, there is a remote code execution (RCE) vulnerability that allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address.
Risk Assessment
This vulnerability poses a serious security risk by allowing attackers to gain full access to the operating system. It could lead to unauthorized access to data and potential damage to the organization's IT infrastructure.
Recommendation
It is recommended to update OPNsense to version 26.1.8 or later to eliminate this vulnerability. Additionally, conducting a user privilege audit and monitoring system logs for potential abuse is advisable.
Original NVD description (English source)
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.