Home / Vulnerability Intelligence / CVE-2026-44194

CVE-2026-44194 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: May 14, 2026

OPNsense - Remote Code Execution

Published: May 13, 2026Updated: May 14, 2026Remote Exploitable

Overview

OPNsense < 26.1.8 contains an authenticated remote code execution caused by input validation bypass in local user synchronization flow, letting users with user-management privileges execute arbitrary system commands as root, exploit requires user-management privileges.

Severity & Score

Severity: Critical

CVSS Score: 9.1

EPSS Score: 13.0%(Probability of exploitation in next 30 days)

Impact

Users with user-management privileges can execute arbitrary system commands as root, leading to full system compromise.

Mitigation

Upgrade to version 26.1.8 or later.

References

https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6

Social Media Activity(2 posts)

OffSequence

@offseq

May 14, 2026

🚨 CVE-2026-44194 (CVSS 9.1): OPNsense core <26.1.8 is vulnerable to OS command injection via sync_user.php. Authenticated users with user-management rights can gain root. Update to 26.1.8 ASAP. https://radar.offseq.com/threat/cve-2026-44194-cwe-78-improper-neutralization-of-s-a7008329 #OffSeq #OPNsense #Vuln #BlueTeam

View original post

OffSequence

@offseq

May 14, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-44194
Severity: Critical
CVSS Score: 9.1
Type: remote_code_execution
Status: unconfirmed
EPSS: 13.0%
Social Posts: 2

CWE

CWE-78

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score

13.0%Probability of exploitation in the next 30 days