CVE-2026-63442

Status: DeferredHigh (8.1)—

Severity8.1High · CVSS 3.1

Exploitation probability0.29 %higher than 20% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line.

Read full descriptionShow less

An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.

CVSS

Base score: 8.1
Version: 3.1
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.29 %
Percentile among all scored CVEs: 20
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement90 %
Primary impactT1499 Endpoint Denial of Serviceimpact65 %
Secondary impactT1110 Brute Forcecredential access70 %

Vector AV:A/PR:N/UI:N; las líneas forjadas en el login bloquean IPs de administración/DNS (DoS) y permiten eludir el bloqueo de fuerza bruta, según la descripción.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability Scanning User Account Management Threat Intelligence Program Privileged Account Management Password Policies Network Segmentation

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Opnsense — Opnsense^AI

CWEs

CWE-117

References

Show 3 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-63442",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63442",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-15T20:24:38.956809Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "opnsense",
          "product": "core",
          "versions": [
            {
              "status": "affected",
              "version": "< 26.1.11"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-15T16:18:19.157",
  "references": [
    {
      "url": "https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11."
    }
  ],
  "lastModified": "2026-10-16T18:18:00.230",
  "sourceIdentifier": "security-advisories@github.com"
}