CVE-2026-44193: OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restoreconfigsection fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44193?
The severity of CVE-2026-44193 is classified as high due to its potential impact leading to Remote Code Execution.
How do I fix CVE-2026-44193?
To fix CVE-2026-44193, upgrade to OPNsense version 26.1.7 or later where the vulnerability has been patched.
What versions of OPNsense are affected by CVE-2026-44193?
CVE-2026-44193 affects all versions of OPNsense prior to 26.1.7.
What is the impact of exploiting CVE-2026-44193?
Exploiting CVE-2026-44193 allows an attacker to execute arbitrary code on the system remotely.
Is CVE-2026-44193 specific to certain configurations of OPNsense?
CVE-2026-44193 is not specific to certain configurations; it affects the XMLRPC interface across all standard deployments of the affected versions.