CVE-2026-44194

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6	Exploit Mitigation Vendor Advisory
https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de la versión 26.1.8, una vulnerabilidad de ejecución remota de código (RCE) autenticada en el núcleo de OPNsense permite a un usuario con privilegios de gestión de usuarios ejecutar comandos de sistema arbitrarios como root. Un atacante puede omitir la validación de entrada formateando su carga útil maliciosa como una dirección de correo electrónico conforme, permitiendo que los comandos de shell lleguen al sistema operativo subyacente. La falla existe en el flujo de sincronización de usuarios locales, dentro de core/src/opnsense/scripts/auth/sync_user.php. Esta vulnerabilidad está corregida en la versión 26.1.8.

Information

Published : 2026-05-13 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44194

Mitre link : CVE-2026-44194

CVE.ORG link : CVE-2026-44194

JSON object : View

Products Affected

opnsense

opnsense

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-44194", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44194", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-15T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opnsense", "product": "core", "versions": [{"status": "affected", "version": "< 26.1.8"}]}]}], "published": "2026-05-13T22:16:43.673", "references": [{"url": "https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8."}, {"lang": "es", "value": "OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de la versi\u00f3n 26.1.8, una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) autenticada en el n\u00facleo de OPNsense permite a un usuario con privilegios de gesti\u00f3n de usuarios ejecutar comandos de sistema arbitrarios como root. Un atacante puede omitir la validaci\u00f3n de entrada formateando su carga \u00fatil maliciosa como una direcci\u00f3n de correo electr\u00f3nico conforme, permitiendo que los comandos de shell lleguen al sistema operativo subyacente. La falla existe en el flujo de sincronizaci\u00f3n de usuarios locales, dentro de core/src/opnsense/scripts/auth/sync_user.php. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 26.1.8."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0EDE7AC-7C9D-4244-9120-DA3CDB7AAB2C", "versionEndExcluding": "26.1.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}