Remote Code Execution Vulnerability in OPNsense Firewall by Deciso
CVE-2026-44194

9.1CRITICAL

Key Information:

Vendor

Opnsense

Status
Core
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44194?

OPNsense, a FreeBSD-based firewall and routing platform, is affected by an authenticated Remote Code Execution vulnerability that allows users with user-management privileges to execute arbitrary system commands as root. By exploiting input validation flaws, an attacker can format a malicious payload as a compliant email address, thus bypassing security measures and delivering shell commands directly to the operating system. This issue resides in the local user synchronization process and has been resolved in version 26.1.8.

Affected Version(s)

core < 26.1.8

References

https://github.com/opnsense/core/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.