CVE-2026-119423 — Vulnerability intelligence

—

Published: 2026-10-30T12:16:39.210

CVSS

6.9

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.

Sources

• CVE-2026-119423
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory