CVE-2026-63442: core < 26.1.11

Affected technology

core · < 26.1.11
opnsense

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Adjacent network · No privileges required · No user interaction required

What an attacker can do

An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. Vendor/CNA’s CVSS 3.1 assessment (base score 8.1/10) rates confidentiality impact as none; integrity and availability impact as high.