Is CVE-2026-44194 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44194 being exploited in the wild.

How severe is CVE-2026-44194?

Critical severity, with a CVSS score of 9.1, published 13 May 2026.

Is there a fix for CVE-2026-44194?

A patch was published on 2026-05-13: Vulnerability fixed in version 26.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44194 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44194?

Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44194: OPNsense OS command injection in user management

CVE-2026-44194 · Severity: critical · CVSS 9.1 · Published 2026-05-13

OPNsense is a firewall and routing platform used to secure corporate and private networks. A security flaw allows an administrator with user-management permissions to execute malicious commands on the underlying operating system with the highest level of authority (root). This could lead to a complete takeover of the firewall, allowing an attacker to intercept network traffic, disable security protections, or gain a foothold in the internal network.

Technologies: OPNsense. Vendors: OPNsense.

Quick answers

Is CVE-2026-44194 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44194 being exploited in the wild.
How severe is CVE-2026-44194?: Critical severity, with a CVSS score of 9.1, published 13 May 2026.
Which products and versions are affected?: OPNsense < 26.1.8.
Is there a fix for CVE-2026-44194?: A patch was published on 2026-05-13: Vulnerability fixed in version 26.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44194 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44194?: Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in OPNsense core within the local user synchronization script (core/src/opnsense/scripts/auth/sync_user.php). The root cause is the improper neutralization of the $username variable when passed to the mwexecf function, which executes shell commands. While the web interface and API validate usernames, they permit valid email addresses; an attacker can exploit this by wrapping shell metacharacters in quotes within the 'local-part' of an email address. This payload bypasses validation but is interpreted by the shell when the script invokes pluginctl. Successful exploitation requires high privileges (user-management) but results in arbitrary command execution as the root user. The issue is fixed in version 26.1.8 by properly parameterizing the shell command.

Affected products

OPNsense OPNsense core < 26.1.8

Timeline

2026-05-12: advisory: GitHub Security Advisory published
2026-05-13: disclosed: CVE-2026-44194 published to NVD
2026-05-13: patched: Vulnerability fixed in version 26.1.8

References

https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.