CVE-2026-119423

Medium

Description

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.

SeverityMedium

CVSS5.3

Exploit probability—

ProductOpnsense Core

PublishedOct 30, 2026

First seenNov 4, 2026

Weakness typeCWE-117CWE-117

How to fix

Update

opnsense core26.7.8 or later

Patches

Vendor advisories

github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv

Affected products

Product	Affected versions	Fixed in
opnsense core	v < 26.7.8	26.7.8

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.