What’s Vulnerable › Products

opnsense core vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your opnsense core version is affected

Latest opnsense core vulnerabilities

• CVE-2026-71490 — OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection (CVSS 7.1)
• CVE-2026-63442 — OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking (CVSS 8.1)
• CVE-2026-58395 — OPNsense: XPath injection in MVC safe-delete (CVSS 4.3)
• CVE-2026-58394 — OPNsense: Stored XSS in Administration Settings via Certificate Description (CVSS 5.2)
• CVE-2026-58393 — OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files (CVSS 5.9)
• CVE-2026-58392 — OPNsense: Stored XSS in Services: NTP GPS (CVSS 5.4)
• CVE-2026-58391 — OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout (CVSS 5.4)
• CVE-2026-58390 — OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views (CVSS 8.0)
• CVE-2026-57155 — OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer (CVSS 9.9)
• CVE-2026-53582 — OPNsense: XPATH Injection can disclose any secret in config.xml (CVSS 7.1)
• CVE-2026-53581 — ntp: write path traversal (CVSS 9.0)