Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119409OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting

High 7.2

In plain English

A high-severity OS command injection in core from opnsense. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)2.5%top 15.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.

Affected products (as reported)

Vendor	Product	Versions
opnsense	core	0 – before 26.7.8

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-p683-f7x2-pm4p) vendor-advisory
https://github.com/opnsense/core/commit/1cc41fc39da99d59818c789b3b561f1515126f47 patch
https://github.com/opnsense/core/commit/8e214533d33c3af7481e86f616ee615adc6a0a73 patch
https://github.com/opnsense/update/commit/9bfd3b7020499b6032ee64804193a9f3ce8178fa patch
https://github.com/opnsense/update/blob/a2b8a10ba85f13b2cd002abb4c8692dde99f0261/src/update/opnsense-update.sh.in#L165 technical-description
https://abraxaslabs.tech/research/opnsense-firmware-mirror-sed third-party-advisory
https://github.com/opnsense/core product
VulnCheck Advisory: OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting third-party-advisory