Is OPNsense 26.1.5 affected?

CVSS 9.1

5 known vulnerabilities affect 26.1.5 (highest CVSS 9.1).

Your branch 26.1 has reached end of life (Jul 15, 2026).

14 newer releases in its track, up to 26.7.7. What changed up to 26.7.7

Vulnerabilities affecting 26.1.5

9.1
CVE-2026-45158 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell scr… fixed in 26.1.8
9.1
CVE-2026-44193 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution.… fixed in 26.1.7
9.1
CVE-2026-44194 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privil… fixed in 26.1.8
8.2
CVE-2026-34578 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ld… fixed in 26.1.6
5.3
CVE-2026-44195 OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication… fixed in 26.1.7