OPNsense
Network · products/opnsense.yaml · RSS
Latest 26.7.7 Oct 13, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 26.7 (Xenial Xenops) | 26.7.7 | Jul 15, 2026 | — · maintained |
| 26.1 (Witty Woodpecker) | 26.1.11 | Jan 28, 2026 | Jul 15, 2026 · ended |
| 25.7 (Visionary Viper) | 25.7.11 | Jul 22, 2025 | Jan 28, 2026 · ended |
| 25.1 (Ultimate Unicorn) | 25.1.12 | Jan 28, 2025 | Jul 23, 2025 · ended |
| 24.7 (Thriving Tiger) | 24.7.12 | Jul 23, 2024 | Jan 28, 2025 · ended |
| 24.1 (Savvy Shark) | 24.1.10 | Jan 26, 2024 | Jul 25, 2024 · ended |
| 23.7 (Restless Roadrunner) | 23.7.12 | Jul 28, 2023 | Jan 26, 2024 · ended |
| 23.1 (Quintessential Quail) | 23.1.11 | Jan 25, 2023 | Jul 28, 2023 · ended |
| 22.7 (Powerful Panther) | 22.7.11 | Jul 25, 2022 | Jan 25, 2023 · ended |
| 22.1 (Observant Owl) | 22.1.10 | Jan 25, 2022 | Jul 25, 2022 · ended |
| 21.7 (Noble Nightingale) | 21.7.8 | Jul 23, 2021 | Jan 25, 2022 · ended |
| 21.1 (Marvelous Meerkat) | 21.1.9 | Jan 26, 2021 | Jul 23, 2021 · ended |
| 20.7 (Legendary Lion) | 20.7.8 | Jul 28, 2020 | Jan 26, 2021 · ended |
| 20.1 (Keen Kingfisher) | 20.1.9 | Jan 29, 2020 | Jul 28, 2020 · ended |
| 19.7 (Jazzy Jaguar) | 19.7.10 | Jul 15, 2019 | Jan 29, 2020 · ended |
| 19.1 (Inspiring Iguana) | 19.1.10 | Jan 28, 2019 | Jul 15, 2019 · ended |
| 18.7 (Happy Hippo) | 18.7.10 | Jul 29, 2018 | Jan 28, 2019 · ended |
| 18.1 (Groovy Gecko) | 18.1.13 | Jan 26, 2018 | Jul 29, 2018 · ended |
| 17.7 (Free Fox) | 17.7.12 | Jul 26, 2017 | Jan 26, 2018 · ended |
| 17.1 (Eclectic Eagle) | 17.1.11 | Jan 27, 2017 | Jul 26, 2017 · ended |
| 16.7 (Dancing Dolphin) | 16.7.14 | Jul 26, 2016 | Jan 27, 2017 · ended |
| 16.1 (Crafty Coyote) | 16.1.20 | Jan 28, 2016 | Jul 26, 2016 · ended |
| 15.7 (Brave Badger) | 15.7.25 | Jul 2, 2015 | Jan 28, 2016 · ended |
| 15.1 (Ascending Albatross) | 15.1.12 | Jan 2, 2015 | Jul 2, 2015 · ended |
Recent releases
securityFixes CVE-2026-45158: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell scr…
securityFixes CVE-2026-44194: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privil…
securityFixes CVE-2026-44193: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution.…
securityFixes CVE-2026-44195: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication…
securityFixes CVE-2026-34578: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ld…
Security advisories
9.1 CVE-2026-45158 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell scr…
9.1 CVE-2026-44193 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution.…
9.1 CVE-2026-44194 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privil…
5.3 CVE-2026-44195 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication…
8.2 CVE-2026-34578 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ld…
6.3 CVE-2026-30868 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CS…
6.4 CVE-2019-25373 OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the category parameter. Attackers c…
6.1 CVE-2019-25374 OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks parameter in vpn_ipsec_settings.php. A…
6.1 CVE-2019-25375 OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the mailserver parameter. Atta…
6.1 CVE-2019-25376 OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL param…
5.4 CVE-2019-25377 OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scripts via the value parameter. Attackers…
5.4 CVE-2019-25368 OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diag_backup.php endpoint that allow attackers to inject malicious scripts through multiple parameters including GDrive_GD…
6.4 CVE-2019-25369 OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter.…
6.1 CVE-2019-25370 OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through multiple parameters. Attackers can send P…
6.1 CVE-2019-25371 OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host param…
6.1 CVE-2019-25372 OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host param…
9.1 CVE-2025-50989 OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a s…
9.8 CVE-2023-27152 DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication.
5.4 CVE-2023-44275 OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.
5.4 CVE-2023-44276 OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.