Hi,
is OPNsense affected by https://www.strongswan.org/blog/2026/06/08/strongswan-vulnerability-(cve-2026-47895).html ?
Looks like 6.0.6 is the version currently installed with 26.1.9.
As this might be used for RCE without any authentication, it should be addressed, if affected.
Thank you.
Scope of this seems to be pretty contained:
Servers that don't use EAP or XAuth authentication are not vulnerable to remote attacks.
Yep fixed in 6.0.7 so we're looking at that for 26.1.10
https://github.com/strongswan/strongswan/releases/tag/6.0.7