What is the CVSS score of CVE-2026-44194?

CVE-2026-44194 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of OPNsense are affected by CVE-2026-44194?

OPNsense firewalls running versions before 26.1.8 are vulnerable to remote code execution by users with user-management privileges, with publicly available exploit code increasing the risk of…. A patch is available.

How to fix or mitigate CVE-2026-44194?

Within 24 hours: Identify all OPNsense deployments and document versions running prior to 26.1.8. Within 7 days: Deploy OPNsense 26.1.8 or later to all affected firewalls, starting with internet-facing and critical network segments. Within 30 days: Complete patching across all instances, verify successful updates, and review user-management privilege assignments.

OPNsense CVE-2026-44194

EUVD-2026-30184 CRITICAL

OS Command Injection (CWE-78)

2026-05-13 security-advisories@github.com

PHP RCE Command Injection Opnsense

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:28 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

DescriptionGitHub Advisory

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.

AnalysisAI

Authenticated remote code execution in OPNsense firewall versions prior to 26.1.8 allows a user with user-management privileges to execute arbitrary commands as root by smuggling shell payloads inside an email-address-formatted field processed by the local user synchronization script. Publicly available exploit code exists per SSVC, though EPSS scoring (0.13%) indicates low predicted mass exploitation; SSVC classifies technical impact as total but automation as no. No active exploitation has been confirmed in CISA KEV at time of analysis.

Technical ContextAI

OPNsense is an open-source FreeBSD-based firewall and routing platform whose web UI and management scripts are written largely in PHP. The flaw is rooted in core/src/opnsense/scripts/auth/sync_user.php, the helper that synchronizes local user accounts and is invoked with root privileges. The root cause is CWE-78 (OS Command Injection): the email-address input is passed to a shell context after only superficial format validation, so a syntactically valid email string that also contains shell metacharacters (e.g., backticks, $(), pipes) survives validation and is interpreted by the underlying OS shell. Because the script runs as root, any injected command inherits full system privileges, turning a legitimate management workflow into a full host takeover primitive.

RemediationAI

Vendor-released patch: upgrade OPNsense core to 26.1.8 or later, which corrects input handling in core/src/opnsense/scripts/auth/sync_user.php; details are in the GitHub Security Advisory at https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6. Until the upgrade is applied, restrict the user-management privilege to a minimal set of trusted accounts and audit existing assignments - this is the cheapest compensating control because PR:H means an attacker must already hold this role. Additionally, ensure the OPNsense web/management interface is not reachable from untrusted networks (bind to a management VLAN or enforce firewall rules limiting source IPs); side effect is reduced remote-admin convenience. Review logs for recent local user create/sync operations containing unusual email values (backticks, $(), pipes, semicolons) to detect prior exploitation attempts before patching.