← CVE Intelligence

CVE-2026-44193

OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method PUBLISHED

Description (CNA)

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.

Affected (CNA)

Vendor / productVersions
opnsense / coreaffected < 26.1.7

CWE

CWE-88

References

ADP enrichment

CISA-ADP

No English description supplied.