# CVE-2026-123025

Authenticated WebGUI RCE as root via OPNsense os-acme-client Google Cloud DNS plugin.

- Page: https://www.vulneraibility.com/cve/CVE-2026-123025
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-78
- Published: 2026-11-05

## Affected versions

- OPNsense os-acme-client: affected <= 4.17.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated attacker issuing/renewing certs can execute arbitrary shell commands as root via the WebGUI/API.

## Action

Immediate action required

## Recommendation

Restrict admin access, disable os-acme-client GCloud DNS validation, and apply vendor patch ASAP.

## References

- [other] https://github.com/opnsense/plugins/pull/5873

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.