Critical severity · published Sep 8, 2026
CVE-2026-53581
ntp: write path traversal
9.0
CVSS
0.5%
EPSS
No
On KEV
Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
Low
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · opnsense
< 26.1.9; < 26.4_20 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53581
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53581
github.com
https://github.com/opnsense/core/security/advisories/GHSA-872g-g543-j37m
More from core
9.9
CVE-2026-57155
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
9.1
CVE-2026-45158
OPNsense: Command Injection via Attacker-Controlled DHCP Config
9.1
CVE-2026-44194
OPNsense: RCE on user managment
9.1
CVE-2026-44193
OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method
8.2
CVE-2026-34578
OPNsense has an LDAP Injection via Unsanitized Username in Authentication