CVE-2026-53581 – OPNsense core
“When the firewall itself can be rewritten as root, the perimeter stops protecting you and starts working against you.”
OPNsense has patched a path traversal flaw in the NTP configuration module of its FreeBSD-based firewall and routing platform. CVE-2026-53581 has a CVSS score of 9.0, Critical severity. An attacker with access to the NTP configuration can manipulate the GPS or PPS serial port parameter to escape the intended directory and write attacker-controlled data to any file on the system as root. This creates a direct path to elevation of privilege on the device that guards the network edge.
Proof-of-concept code exists for this vulnerability. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core fix the issue. Upgrade all OPNsense firewalls to the patched release now.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- High
- User Interaction
- None
- CWE Classification
- CWE-22