Is CVE-2026-63442 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63442 being exploited in the wild.

How severe is CVE-2026-63442?

High severity, with a CVSS score of 8.1, published 15 October 2026.

Is there a fix for CVE-2026-63442?

Yes: fixed in 26.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63442 attacked?

It is attacked over the network.

Am I affected by CVE-2026-63442?

Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63442: OPNsense newline injection in WebGUI login lockout bypass

CVE-2026-63442 · Severity: high · CVSS 8.1 · Published 2026-10-15

OPNsense is a FreeBSD-based firewall and routing platform that protects networks by enforcing authentication and blocking brute-force attacks. An attacker with network access to the login page can inject fake login failures or successes by exploiting improper handling of line-feed characters in the login form, allowing them to lock out legitimate administrators or bypass password-guessing protections without providing credentials.

Technologies: OPNsense. Vendors: OPNsense.

Quick answers

Is CVE-2026-63442 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63442 being exploited in the wild.
How severe is CVE-2026-63442?: High severity, with a CVSS score of 8.1, published 15 October 2026.
Which products and versions are affected?: OPNsense Prior to 26.1.11.
Is there a fix for CVE-2026-63442?: Yes: fixed in 26.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63442 attacked?: It is attacked over the network.
Am I affected by CVE-2026-63442?: Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.1.11

Technical details

The vulnerability is a newline injection flaw in the unauthenticated WebGUI login username field that allows an attacker to inject carriage-return and line-feed characters. These characters survive syslog-ng processing and reach the lockout_handler script, where readline() treats the injected fragment as a separate authentication event. The IP parsing logic in lockout_handler incorrectly selects the first IP address instead of the last, permitting an attacker to forge lockout events for other IP addresses or reset their own brute-force counter via network access alone.

Affected products

OPNsense OPNsense Prior to 26.1.11

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.