OPNsense Firewall Vulnerability Allows Remote Information Disclosure (CVSS 8.2)
Summary
CERT-Bund has issued a security advisory (WID-SEC-2026-1044) regarding a vulnerability in OPNsense, an open-source firewall distribution based on FreeBSD. The vulnerability, with a CVSS Base Score of 8.2 (high), allows remote, anonymous attackers to disclose sensitive information. Affected versions include OPNsense prior to version 26.1.6. A mitigation measure is available as of April 10, 2026.
What changed
CERT-Bund published security advisory WID-SEC-2026-1044 disclosing a high-severity vulnerability (CVSS 8.2) in OPNsense firewall software. The vulnerability enables remote, anonymous information disclosure through exploitation of the affected system. Version 26.1.6 addresses the issue and a mitigation is available.
Organizations running OPNsense firewalls should immediately verify their installation versions and apply the available patch or mitigation. Failure to address high-severity vulnerabilities in network security infrastructure could expose internal systems and data to unauthorized disclosure by remote attackers.
What to do next
- Check if OPNsense installations are running version 26.1.6 or later
- Apply available mitigation measures immediately
- Update to patched version 26.1.6 or later if not already done
Archived snapshot
Apr 11, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1044] OPNsense: Schwachstelle ermöglicht Offenlegung von Informationen CVSS Base Score 8.2 (hoch) CVSS Temporal Score 7.4 (hoch) Remoteangriff ja Datum 09.04.2026 Stand 10.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Sonstiges
Produktbeschreibung
OPNsense ist eine freie Firewall-Distribution auf Basis von FreeBSD.
Produkte
09.04.2026
- Open Source OPNsense <26.1.6
Angriff
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OPNsense ausnutzen, um Informationen offenzulegen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.