What is the CVSS score of CVE-2026-45158?

CVE-2026-45158 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of OPNsense are affected by CVE-2026-45158?

OPNsense firewall deployments running versions before 26.1.8 are vulnerable to remote code execution as root by authenticated administrators.. A patch is available.

How to fix or mitigate CVE-2026-45158?

Within 24 hours: Audit all OPNsense instances to identify versions prior to 26.1.8; implement MFA for administrative access if not already in place. Within 7 days: Apply security patch to OPNsense version 26.1.8 or later on all vulnerable instances. Within 30 days: Review and strengthen administrative credential management practices; audit logs for unauthorized administrative activity during the pre-patch period.

OPNsense CVE-2026-45158

EUVD-2026-30202 CRITICAL

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-05-13 security-advisories@github.com

RCE Opnsense

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:27 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

DescriptionGitHub Advisory

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.

AnalysisAI

Remote code execution in OPNsense firewall (core versions prior to 26.1.8) allows authenticated administrators to execute arbitrary commands as root by injecting shell metacharacters into DHCP interface configuration fields that are passed unsanitized to an underlying shell script. The flaw carries a 9.1 CVSS score with scope change reflecting privilege escalation from the web UI context to OS root, though no public exploit has been identified at time of analysis and EPSS estimates only a 0.23% probability of near-term exploitation.

Technical ContextAI

OPNsense is a FreeBSD-based open-source firewall and routing platform forked from pfSense, where backend configuration changes are typically applied by shell scripts that consume values rendered from the web GUI's XML config store. CPE data confirms the affected product is opnsense:opnsense (the 'core' package per the EUVD entry). The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command, i.e., argument injection): user-supplied DHCP interface configuration values are interpolated into a shell script without proper quoting or sanitization, so an operator who can write to those fields can break out of the intended argument context and have the shell interpret attacker-controlled tokens as commands executed by the script's root-privileged process.

RemediationAI

Vendor-released patch: OPNsense core 26.1.8 - upgrade via the built-in firmware update mechanism (System → Firmware → Updates) and consult the GitHub Security Advisory at https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm for advisory details. If immediate patching is not possible, compensating controls should focus on shrinking the population of accounts that can reach the vulnerable DHCP configuration: restrict the web GUI to a dedicated management VLAN or VPN (lan_anchor/firewall rules on the WebGUI anchor), enforce MFA on admin logins, and review the privilege list under System → Access → Users to ensure only fully trusted operators hold the 'Services: DHCPv4/DHCPv6: Edit' or equivalent permissions - accepting the trade-off that delegated network operations become slower. Disabling DHCP server functionality on affected interfaces also removes the injection sink but breaks address assignment for any clients that rely on it.