CVE-2026-44193CWE-88

OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method

Critical · published May 13, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00856 · 58.0th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-05-13T21:52Z
EPSS history
Timeline
  • 13 MAY 21:52Z
    OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method
    cvelistv5