Is CVE-2026-53581 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53581 being exploited in the wild.

How severe is CVE-2026-53581?

Critical severity, with a CVSS score of 9, published 8 September 2026.

Which products and versions are affected?

OPNsense opnsense/core prior to 26.1.9; BE/opnsense/core prior to 26.4_20.

Is there a fix for CVE-2026-53581?

A patch was published on 2026-09-08: Patched in opnsense/core 26.1.9 and BE/opnsense/core 26.4_20 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53581 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-53581?

Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53581: OPNsense path traversal in NTP configuration module

CVE-2026-53581 · Severity: critical · CVSS 9 · Published 2026-09-08

OPNsense is a firewall and routing platform based on FreeBSD that protects corporate networks. A critical vulnerability in its NTP configuration module allows administrators or users with limited GUI access to overwrite any file on the system as the root user, potentially compromising the entire firewall and exposing or modifying all network traffic and configuration data.

Technologies: OPNsense. Vendors: OPNsense.

Quick answers

Is CVE-2026-53581 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53581 being exploited in the wild.
How severe is CVE-2026-53581?: Critical severity, with a CVSS score of 9, published 8 September 2026.
Which products and versions are affected?: OPNsense opnsense/core prior to 26.1.9; BE/opnsense/core prior to 26.4_20.
Is there a fix for CVE-2026-53581?: A patch was published on 2026-09-08: Patched in opnsense/core 26.1.9 and BE/opnsense/core 26.4_20 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53581 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53581?: Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability in the ntpd_configure_gps() and ntpd_configure_pps() functions (src/etc/inc/ntpd.inc) concatenates user-supplied serial port parameters directly with the /dev/ directory without normalization or validation. An attacker with NTP configuration access can inject directory traversal sequences (../) to write arbitrary files, including SSH keys and configuration files, with root privileges. Patches are available in versions 26.1.9 and 26.4_20.

Affected products

OPNsense OPNsense opnsense/core prior to 26.1.9; BE/opnsense/core prior to 26.4_20

Timeline

2026-06-02: disclosed: Vulnerability disclosed on GitHub security advisory
2026-09-08: patched: Patched in opnsense/core 26.1.9 and BE/opnsense/core 26.4_20

References

https://github.com/opnsense/core/security/advisories/GHSA-872g-g543-j37m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.