CVE-2026-119409: opnsense core

Affected products, as the CNA wrote them
Vendor	Product	Versions
opnsense	core	affected before 26.7.8 semver unaffected 26.7.8 semver Other versions: unaffected

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.6	High	4.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	CNA (VulnCheck)Used for this record
7.2	High	3.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	CNA (VulnCheck)

CISA KEV Not listed.
EPSS 0.025, the 84th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 30 Oct 2026. New records show when each source confirmed them.

Sources

References from the CNA

github.com/opnsense/core/security/advisories/GHSA-p683-f7x2-pm4p vendor-advisory
github.com/opnsense/core/commit/1cc41fc39da99d59818c789b3b561f1515126f47 patch
github.com/opnsense/core/commit/8e214533d33c3af7481e86f616ee615adc6a0a73 patch
github.com/opnsense/update/commit/9bfd3b7020499b6032ee64804193a9f3ce8178fa patch
github.com/opnsense/update/blob/a2b8a10ba85f13b2cd002abb4c8692dde99f0261/src/update/opnsense-update.sh.in#L165 technical-description
abraxaslabs.tech/research/opnsense-firmware-mirror-sed third-party-advisory
github.com/opnsense/core product
www.vulncheck.com/advisories/opnsense-before-26.7.8-root-command-injection-via-firmware-mirror-setting third-party-advisory

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.