CVE-2026-44193: OPNsense XMLRPC RCE Vulnerability

CVE-2026-44193 Overview

OPNsense is a FreeBSD-based firewall and routing platform deployed at network perimeters. CVE-2026-44193 affects the XMLRPC method opnsense.restore_config_section, which fails to sanitize user-supplied input. An authenticated attacker with high privileges can leverage this flaw to achieve Remote Code Execution (RCE) on the underlying operating system. The vulnerability is classified under CWE-88 (Argument Injection) and is fixed in OPNsense 26.1.7.

Critical Impact

Successful exploitation grants arbitrary code execution on a perimeter security appliance, enabling attackers to pivot into protected network segments.

Affected Products

• OPNsense versions prior to 26.1.7
• FreeBSD-based deployments using the XMLRPC interface
• OPNsense firewall and routing platform installations

Discovery Timeline

• 2026-05-13 - CVE-2026-44193 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44193

Vulnerability Analysis

The flaw resides in the opnsense.restore_config_section XMLRPC method exposed by OPNsense. This method accepts user-supplied input intended for configuration restoration but does not properly sanitize the data before passing it to underlying system operations. Attackers can inject crafted arguments that the appliance subsequently processes as executable commands.

Because OPNsense typically runs network-facing services with elevated privileges, successful exploitation yields code execution in a security-critical context. The scope change (S:C) indicates that the impact extends beyond the vulnerable component into the broader system, including routing, NAT, and firewall functions.

Root Cause

The root cause is improper neutralization of argument delimiters in a command, mapped to [CWE-88]. The XMLRPC handler accepts structured input for the restore_config_section operation but lacks the input validation required to prevent argument injection into downstream calls. Untrusted data flows from the XMLRPC request body into operations that interpret it with elevated trust.

Attack Vector

The attack vector is network-based and requires high privileges, meaning the attacker must possess valid authenticated access to the XMLRPC endpoint. No user interaction is required. An attacker with API access, stolen credentials, or compromised administrative accounts can issue a crafted XMLRPC call to opnsense.restore_config_section containing malicious payload data. The unsanitized input is then processed in a context that allows command execution on the firewall host.

For technical specifics, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-44193

Indicators of Compromise

• XMLRPC requests targeting the opnsense.restore_config_section method from unexpected source addresses
• Unusual child processes spawned by the OPNsense web server or PHP-FPM workers
• Unexpected modifications to /conf/config.xml or files under /usr/local/etc/
• Outbound network connections initiated by firewall processes to attacker-controlled hosts

Detection Strategies

• Monitor OPNsense web server access logs for POST requests to XMLRPC endpoints with anomalous payload sizes or structure
• Alert on authentication events for administrative accounts followed by XMLRPC API activity outside of change windows
• Inspect process telemetry on the firewall host for shell processes descending from web service parents

Monitoring Recommendations

• Centralize OPNsense system and authentication logs into a SIEM for correlation across the environment
• Track configuration changes through the OPNsense audit log and compare against approved change tickets
• Baseline normal XMLRPC traffic and flag deviations in method names, frequency, or originating source

How to Mitigate CVE-2026-44193

Immediate Actions Required

• Upgrade OPNsense to version 26.1.7 or later without delay
• Rotate credentials for all administrative and API accounts that interact with XMLRPC
• Audit recent XMLRPC activity for evidence of exploitation prior to patching
• Restrict management interface exposure to trusted administrative networks only

Patch Information

The vulnerability is resolved in OPNsense 26.1.7. The fix is documented in the OPNsense GitHub Security Advisory GHSA-xxp9-93cr-x54p. Administrators should apply the update through the standard OPNsense firmware upgrade process and verify the running version after reboot.

Workarounds

• Block access to the XMLRPC endpoint from untrusted networks using firewall rules on the management interface
• Enforce multi-factor authentication on all administrative accounts to reduce credential abuse risk
• Disable or restrict the XMLRPC service if it is not required for high-availability synchronization or automation

# Restrict management access to a trusted subnet (example pf rule)
pass in quick on $mgmt_if proto tcp from 10.0.0.0/24 to ($mgmt_if) port 443
block in quick on $mgmt_if proto tcp to ($mgmt_if) port 443