What is the CVSS score of CVE-2026-44193?

CVE-2026-44193 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of OPNsense are affected by CVE-2026-44193?

OPNsense firewalls running versions prior to 26.1.7 contain a critical remote code execution vulnerability in the XMLRPC management interface, accessible only to authenticated high-privileged users.. A patch is available.

How to fix or mitigate CVE-2026-44193?

24 hours: Identify all OPNsense deployments and document current versions; review administrator credential security and access logs for anomalies. 7 days: Deploy OPNsense 26.1.7 or later to all affected systems and validate successful patch installation. 30 days: Complete forensic audit of administrative access logs and implement multi-factor authentication for administrative interfaces.

OPNsense CVE-2026-44193

EUVD-2026-30183 CRITICAL

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-05-13 security-advisories@github.com

RCE Opnsense

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:21 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

DescriptionGitHub Advisory

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.

AnalysisAI

Remote code execution in OPNsense firewall versions prior to 26.1.7 allows authenticated high-privileged users to execute arbitrary code via the opnsense.restore_config_section XMLRPC method, which fails to sanitize user-supplied input. The flaw carries a CVSS 9.1 with scope change and total impact, and while publicly available exploit code exists per SSVC, EPSS rates real-world exploitation probability at only 0.23%, suggesting niche rather than mass-scale risk. The vendor has shipped a fix in 26.1.7 and the issue is tracked as GHSA-xxp9-93cr-x54p and EUVD-2026-30183.

Technical ContextAI

OPNsense is a FreeBSD-based open-source firewall and routing platform (cpe:2.3:a:opnsense:opnsense:*) that exposes administrative functionality over an XMLRPC interface - commonly used for High Availability (CARP) configuration synchronization between firewall peers. The vulnerable method opnsense.restore_config_section accepts XML-encoded configuration sections and writes them back into the system configuration; because user-supplied input is not sanitized, the handler is susceptible to CWE-88 (Improper Neutralization of Argument Delimiters in a Command, i.e. argument injection), allowing crafted input within the restore payload to alter command construction during downstream processing and reach OS command execution context. The CVSS scope change (S:C) reflects that exploitation of the XMLRPC component can affect the broader firewall/host security boundary.

RemediationAI

Upgrade to OPNsense 26.1.7 or later, which is the vendor-released patch fixing input sanitization in the opnsense.restore_config_section XMLRPC handler; details are in the upstream advisory at https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p. Until the upgrade is applied, restrict reachability of the XMLRPC/sync endpoint by binding it to a dedicated HA sync interface or management VLAN rather than WAN, enforce firewall rules that only permit the peer HA address to reach the sync port, and rotate the System > High Availability sync password (and any admin credentials with XMLRPC access) to invalidate any leaked high-privilege credentials - be aware that tightening sync ACLs can break HA failover until peers are re-permitted, and credential rotation requires updating both nodes simultaneously to avoid sync interruption.