CVE-2026-44195
Medium
Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword ("Accepted" or "Successful login") between normal brute-force attempts, an attacker can prevent the failure counter from ever reaching the lockout threshold. This vulnerability is fixed in 26.1.7.
SeverityMedium
CVSS5.3
Exploit probability—
ProductOpnsense
PublishedMay 13, 2026
First seenMay 13, 2026
Weakness typeCWE-307CWE-307
How to fix
Update
- opnsense opnsense26.1.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opnsense opnsense | v < 26.1.7 | 26.1.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.