OPNsense

Products

Exploited and recent CVEs

• CVE-2026-123025 Critical 9.4 An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gclou 0.6%
• CVE-2026-57154 High 8.1 OPNsense: Configuration line injection via multiple GUI text fields 0.5%
• CVE-2026-119560 Medium 5.9 OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields 0.3%
• CVE-2026-119425 Medium 5.4 OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP 0.3%
• CVE-2026-119424 Medium 6.8 OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity 0.4%
• CVE-2026-119423 Medium 5.3 OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username 0.4%
• CVE-2026-119409 High 7.2 OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting 2.5%
• CVE-2026-115425 Medium 5.6 Multiple cross-site scripting (XSS) in OPNsense 0.3%
• CVE-2026-71490 High 7.1 OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection 0.4%
• CVE-2026-63442 High 8.1 OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking 0.3%
• CVE-2026-58390 High 8.0 OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views 0.6%
• CVE-2026-58394 Medium 5.2 OPNsense: Stored XSS in Administration Settings via Certificate Description 0.2%
• CVE-2026-58392 Medium 5.4 OPNsense: Stored XSS in Services: NTP GPS 0.3%
• CVE-2026-58395 Medium 4.3 OPNsense: XPath injection in MVC safe-delete 0.4%
• CVE-2026-58393 Medium 5.9 OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files 0.4%
• CVE-2026-57155 Critical 9.9 OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer 0.9%
• CVE-2026-58391 Medium 5.4 OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout 0.3%
• CVE-2026-53582 High 7.1 OPNsense: XPATH Injection can disclose any secret in config.xml 0.7%
• CVE-2026-53581 Critical 9.0 ntp: write path traversal 0.5%
• CVE-2026-45158 Critical 9.1 OPNsense: Command Injection via Attacker-Controlled DHCP Config 0.5%
• CVE-2026-44194 Critical 9.1 OPNsense: RCE on user managment 5.7%
• CVE-2026-44195 Medium 5.3 OPNsense: Authentication lockout bypass 0.3%
• CVE-2026-44193 Critical 9.1 OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method 0.7%
• CVE-2026-34578 High 8.2 OPNsense has an LDAP Injection via Unsanitized Username in Authentication 0.4%
• CVE-2026-30868 Medium 6.3 Cross-Site Request Forgery (CSRF) in opnsense/core 0.2%
• CVE-2025-50989 Critical 9.1 OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a syst 10.9%