CVE-2026-44194

{
  "id": "CVE-2026-44194",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T22:16:43.673",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8."
    },
    {
      "lang": "es",
      "value": "OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de la versión 26.1.8, una vulnerabilidad de ejecución remota de código (RCE) autenticada en el núcleo de OPNsense permite a un usuario con privilegios de gestión de usuarios ejecutar comandos de sistema arbitrarios como root. Un atacante puede omitir la validación de entrada formateando su carga útil maliciosa como una dirección de correo electrónico conforme, permitiendo que los comandos de shell lleguen al sistema operativo subyacente. La falla existe en el flujo de sincronización de usuarios locales, dentro de core/src/opnsense/scripts/auth/sync_user.php. Esta vulnerabilidad está corregida en la versión 26.1.8."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "opnsense",
          "product": "core",
          "versions": [
            {
              "version": "< 26.1.8",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-15T00:00:00+00:00",
          "id": "CVE-2026-44194",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "26.1.8",
              "matchCriteriaId": "A0EDE7AC-7C9D-4244-9120-DA3CDB7AAB2C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}