OPNsense security vulnerabilities
Networking / NAS. Public CVE monitoring for OPNsense. Vendor security advisories are linked on this page.
Built for Operators of this product.
35 public records · 0 security-fix timeline events. 4 published in the last 7 days. 6 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 3
- Medium 9
- Low 1
2026-08-0513 issues2026-11-02
Known exploited
View all known exploitedNo records match this view.
Recently published
Browse catalog- Medium6.9OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login UsernameCheck if you run itEPSS 0.38%Oct 30, 2026
- Medium6.4CA/Cert PEM Imported Payload Allows OpenVPN Directive Injection Leading to Root OS Command ExecutionOpen the advisoryOct 29, 2026
- High7.2Authenticated Root Command Injection via Firmware Mirror Configuration in OPNsenseOpen the advisoryOct 28, 2026
- Medium5.9OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.43%Oct 15, 2026
- High8.0OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.60%Oct 15, 2026
- High7.1OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.73%Oct 15, 2026
- Medium4.3Password-policy lock is cleared by an empty-password Save on system_usermanager_passwordmg.php (CWE-863/696)Open the advisorySep 30, 2026
- Medium5.3Audit log injection via login username in auth_log()Open the advisorySep 15, 2026
- Medium5.4Captive Portal roaming authorizes attacker-controlled IPs through forged ARP bindingsOpen the advisoryAug 26, 2026
- Medium6.5OpenVPN session kill endpoint executes arbitrary management protocol commands through unvalidated (delegated status user to daemon control)Open the advisoryAug 12, 2026