CVE-2026-44193 - Vulnerability Details - OpenCVE

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Opnsense	Core

No data.

No data.

References

Link	Providers
https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p

History

Thu, 14 May 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 13 May 2026 23:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Opnsense Opnsense core
Vendors & Products		Opnsense Opnsense core

Wed, 13 May 2026 22:15:00 +0000

Type	Values Removed	Values Added
Description		OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.
Title		OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method
Weaknesses		CWE-88
References		https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-05-13T21:52:04.150Z

Updated: 2026-05-14T19:51:59.948Z

Reserved: 2026-05-05T15:13:47.570Z

Link: CVE-2026-44193

Vulnrichment

Updated: 2026-05-14T16:03:41.951Z

NVD

Status : Undergoing Analysis

Published: 2026-05-13T22:16:43.533

Modified: 2026-05-14T20:17:07.550

Link: CVE-2026-44193

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44193", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T15:13:47.570Z", "datePublished": "2026-05-13T21:52:04.150Z", "dateUpdated": "2026-05-14T19:51:59.948Z"}, "containers": {"cna": {"title": "OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method", "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "lang": "en", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p"}], "affected": [{"vendor": "opnsense", "product": "core", "versions": [{"version": "< 26.1.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-13T21:52:04.150Z"}, "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7."}], "source": {"advisory": "GHSA-xxp9-93cr-x54p", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T16:03:22.436374Z", "id": "CVE-2026-44193", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T19:51:59.948Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method", "source": {"advisory": "GHSA-xxp9-93cr-x54p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "opnsense", "product": "core", "versions": [{"status": "affected", "version": "< 26.1.7"}]}], "references": [{"url": "https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p", "name": "https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-13T21:52:04.150Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44193", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T16:03:22.436374Z"}}}], "references": [{"url": "https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-14T16:03:41.951Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-44193", "state": "PUBLISHED", "dateUpdated": "2026-05-13T21:52:04.150Z", "dateReserved": "2026-05-05T15:13:47.570Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-13T21:52:04.150Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}