High severity · published Oct 30, 2026
CVE-2026-119409
OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
New
7.2
CVSS
–
EPSS
No
On KEV
Description
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · opnsense
before 26.7.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119409
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119409
vendor-advisory
https://github.com/opnsense/core/security/advisories/GHSA-p683-f7x2-pm4p
patch
https://github.com/opnsense/core/commit/1cc41fc39da99d59818c789b3b561f1515126f47
patch
https://github.com/opnsense/core/commit/8e214533d33c3af7481e86f616ee615adc6a0a73
patch
https://github.com/opnsense/update/commit/9bfd3b7020499b6032ee64804193a9f3ce8178fa
technical-description
https://github.com/opnsense/update/blob/a2b8a10ba85f13b2cd002abb4c8692dde99f0261/src/update/opnsense-update.sh.in#L165
third-party-advisory
https://abraxaslabs.tech/research/opnsense-firmware-mirror-sed
More from core
9.9
CVE-2026-57155
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
9.1
CVE-2026-45158
OPNsense: Command Injection via Attacker-Controlled DHCP Config
9.1
CVE-2026-44194
OPNsense: RCE on user managment
9.1
CVE-2026-44193
OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method
9.0
CVE-2026-53581
ntp: write path traversal