CVE-2026-45158
CRITICAL · 9.1Public PoC confirmed, same-day patch released, high-engagement alert chatter; KEV not yet listed.
What: OPNsense firewall remote code execution via unsanitized DHCP configuration input processed by shell script, allowing unauthenticated root RCE prior to version 26.1.8. CVSS 9.1 CRITICAL.
Why it matters: Published 2026-05-13; public PoC disclosed within hours; affects widely-deployed open-source firewall appliances. Vendor patch (26.1.8) available same day. Active social chatter confirms PoC availability and urgent upgrade messaging from security community.
Where it's seen: Multiple security news aggregators and threat intel platforms reporting; social media amplifying patch urgency; public PoC repositories cited; no KEV listing yet but rapid defender awareness.
RISK: CRITICAL — Unauthenticated root RCE on critical infrastructure (firewalls); public PoC; CVSS 9.1.
Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High