Is CVE-2026-44193 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44193 being exploited in the wild.

How severe is CVE-2026-44193?

Critical severity, with a CVSS score of 9.1, published 13 May 2026.

Is there a fix for CVE-2026-44193?

A patch was published on 2026-05-13: Fix confirmed in version 26.1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44193 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44193?

Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44193: OPNsense remote code execution in XMLRPC restore_config_section

CVE-2026-44193 · Severity: critical · CVSS 9.1 · Published 2026-05-13

OPNsense is an open-source firewall and routing platform used to secure corporate and home networks. A security flaw in its configuration restoration process allows an authorized user with specific administrative privileges to execute malicious commands on the system. If exploited, an attacker could gain full control over the firewall, potentially leading to a complete network compromise or data theft.

Technologies: OPNsense. Vendors: OPNsense.

Quick answers

Is CVE-2026-44193 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44193 being exploited in the wild.
How severe is CVE-2026-44193?: Critical severity, with a CVSS score of 9.1, published 13 May 2026.
Which products and versions are affected?: OPNsense < 26.1.7.
Is there a fix for CVE-2026-44193?: A patch was published on 2026-05-13: Fix confirmed in version 26.1.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44193 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44193?: Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An argument injection vulnerability (CWE-88) exists in OPNsense prior to version 26.1.7 within the XMLRPC API. The 'opnsense.restore_config_section' method fails to sanitize various CLI parameters in the 'local_user_set' function located in 'etc/inc/auth.inc', specifically when handling user-related configuration data. An attacker with 'XMLRPC Library' privileges can submit a crafted XML request containing shell metacharacters in fields such as the username. When the configuration is subsequently synchronized or services are reloaded, the unsanitized input is passed to a shell command executed via 'popen()', resulting in remote code execution with root privileges. This vulnerability is addressed in version 26.1.7.

Affected products

OPNsense OPNsense < 26.1.7

Timeline

2026-04-30: advisory: Original GitHub security advisory published
2026-05-13: disclosed: CVE-2026-44193 published to NVD
2026-05-13: patched: Fix confirmed in version 26.1.7

References

https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.