LeakyCreds
NewInstant webhook alerts now available ā€” notified within seconds of any credential detection.Learn more ā†’
Home / Vulnerability Intelligence / CVE-2026-45158

CVE-2026-45158 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: May 14, 2026

OPNsense - Remote Code Execution

Published: May 13, 2026Updated: May 14, 2026Remote Exploitable

Overview

OPNsense < 26.1.8 contains a remote code execution caused by unsanitized user input passed to DHCP configuration processed by a shell script, letting remote attackers execute code as root, exploit requires network access.

Severity & Score

Severity: Critical
CVSS Score: 9.1
EPSS Score: 23.2%(Probability of exploitation in next 30 days)

Impact

Remote attackers can execute code as root, leading to full system compromise.

Mitigation

Update to version 26.1.8 or later.

References

Social Media Activity(4 posts)

TheHackerWire
TheHackerWire
@thehackerwire
May 14, 2026

šŸ”“ CVE-2026-45158 - Critical (9.1) OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the... šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-45158/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
OffSequence
OffSequence
@offseq
May 14, 2026

šŸšØ CRITICAL: OPNsense core < 26.1.8 has CVE-2026-45158 ā€” command injection in DHCP config allows root RCE. Upgrade to 26.1.8+ now to prevent full system compromise. Details: https://radar.offseq.com/threat/cve-2026-45158-cwe-88-improper-neutralization-of-a-59c85f26 #OffSeq #OPNsense #Vuln #Cybersecurity

View original post
TheHackerWire
TheHackerWire
@thehackerwire
May 14, 2026

šŸ”“ CVE-2026-45158 - Critical (9.1) OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the... šŸ”— https://www.thehackerwire.com/vulnerability/CVE-2026-45158/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
OffSequence
OffSequence
@offseq
May 14, 2026

šŸšØ CRITICAL: OPNsense core < 26.1.8 has CVE-2026-45158 ā€” command injection in DHCP config allows root RCE. Upgrade to 26.1.8+ now to prevent full system compromise. Details: https://radar.offseq.com/threat/cve-2026-45158-cwe-88-improper-neutralization-of-a-59c85f26 #OffSeq #OPNsense #Vuln #Cybersecurity

View original post

Related Resources

Details

CVE ID
CVE-2026-45158
Severity
Critical
CVSS Score
9.1
Type
command_injection
Status
unconfirmed
EPSS
23.2%
Social Posts
4

CWE

  • CWE-88

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score

23.2%Probability of exploitation in the next 30 days