LeakyCreds
NewInstant webhook alerts now available ā€” notified within seconds of any credential detection.Learn more ā†’
Home / Vulnerability Intelligence / CVE-2026-44193

CVE-2026-44193 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: May 14, 2026

OPNsense - Remote Code Execution

Published: May 13, 2026Updated: May 14, 2026Remote Exploitable

Overview

OPNsense < 26.1.7 contains a remote code execution caused by unsanitized user input in the XMLRPC method opnsense.restore_config_section, letting remote attackers execute arbitrary code, exploit requires network access.

Severity & Score

Severity: Critical
CVSS Score: 9.1
EPSS Score: 23.2%(Probability of exploitation in next 30 days)

Impact

Remote attackers can execute arbitrary code, potentially taking full control of the system.

Mitigation

Update to version 26.1.7 or later.

References

Social Media Activity(4 posts)

TheHackerWire
TheHackerWire
@thehackerwire
May 14, 2026

šŸ”“ CVE-2026-44193 - Critical (9.1) OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7. šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-44193/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
OffSequence
OffSequence
@offseq
May 14, 2026

āš ļø CRITICAL: OPNsense core < 26.1.7 vulnerable to argument injection (CVE-2026-44193). Remote code execution possible via XMLRPC method. Update to 26.1.7+ now! https://radar.offseq.com/threat/cve-2026-44193-cwe-88-improper-neutralization-of-a-d4d4bbb8 #OffSeq #OPNsense #Vuln #RCE

View original post
TheHackerWire
TheHackerWire
@thehackerwire
May 14, 2026

šŸ”“ CVE-2026-44193 - Critical (9.1) OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7. šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-44193/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
OffSequence
OffSequence
@offseq
May 14, 2026

āš ļø CRITICAL: OPNsense core < 26.1.7 vulnerable to argument injection (CVE-2026-44193). Remote code execution possible via XMLRPC method. Update to 26.1.7+ now! https://radar.offseq.com/threat/cve-2026-44193-cwe-88-improper-neutralization-of-a-d4d4bbb8 #OffSeq #OPNsense #Vuln #RCE

View original post

Related Resources

Details

CVE ID
CVE-2026-44193
Severity
Critical
CVSS Score
9.1
Type
remote_code_execution
Status
unconfirmed
EPSS
23.2%
Social Posts
4

CWE

  • CWE-88

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score

23.2%Probability of exploitation in the next 30 days