OPNsense has 19 CVEs on record. Disclosure cadence is accelerating: 19 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 16. The median CVSS is 6.8 (medium), with 3 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (4) and CWE-22 (3). Most affected products: core (17), OPNsense firewall (1), os-acme-client (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 19 prev 0
Products
- core 17
- OPNsense firewall 1
- os-acme-client 1
Worst active — by depth score
CVE-2026-57155Critical· 9.9OPNsense is a FreeBSD based firewall and routing platform67CVE-2026-53581Critical· 9.0OPNsense is a FreeBSD based firewall and routing platform62CVE-2026-58390High· 8.0OPNsense is a FreeBSD based firewall and routing platform56CVE-2026-123025Critical· 9.4An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.1752CVE-2026-71490High· 7.1OPNsense is a FreeBSD based firewall and routing platform51
OPNsense vulnerabilities
CVEs affecting OPNsense, newest first. Open any entry for full detail, references, and exploit status.
19 CVEsRSS
CVE-2026-123025Critical· 9.4An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interp…
CVE-2026-57154High· 8.1OPNsense: Configuration line injection via multiple GUI text fields
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line,…
CVE-2026-119409High· 7.2OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell meta…
CVE-2026-119425Medium· 5.4OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observa…
CVE-2026-119560Medium· 5.9OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps…
CVE-2026-119424Medium· 6.8OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines…
CVE-2026-119423Medium· 5.3OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames lik…
CVE-2026-115425Medium· 5.6Multiple cross-site scripting (XSS) in OPNsense
Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a speci…
CVE-2026-53582High· 7.1PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnse…
CVE-2026-58391Medium· 5.4PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without…
CVE-2026-58393Medium· 5.9PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/et…
CVE-2026-58395Medium· 4.3PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an…
CVE-2026-58390High· 8.0PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_nam…
CVE-2026-58394Medium· 5.2PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each …
CVE-2026-63442High· 8.1OPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout…
CVE-2026-57155Critical· 9.9PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV coun…
CVE-2026-71490High· 7.1PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-co…
CVE-2026-58392Medium· 5.4PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses …
CVE-2026-53581Critical· 9.0PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite a…