Is OPNsense 25.7.7 affected?

CVSS 9.1

6 known vulnerabilities affect 25.7.7 (highest CVSS 9.1).

Your branch 25.7 has reached end of life (Jan 28, 2026).

24 newer releases in its track, up to 26.7.7. What changed up to 26.7.7

Vulnerabilities affecting 25.7.7

9.1
CVE-2026-45158 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell scr… fixed in 26.1.8
9.1
CVE-2026-44193 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution.… fixed in 26.1.7
9.1
CVE-2026-44194 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privil… fixed in 26.1.8
8.2
CVE-2026-34578 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ld… fixed in 26.1.6
6.3
CVE-2026-30868 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CS… fixed in 26.1.4
5.3
CVE-2026-44195 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication… fixed in 26.1.7