Brand profile · models not graded yet
Is OPNsense Safe?
OPNsense is open-source firewall software from Deciso, a private Dutch company. Release cadence, CVE history and how updates work, explained.
Ownership & FCC Status
Owner
Deciso B.V. (Middelharnis, Netherlands, private)
FCC Status
Not on the Covered List; whether the 2026 router rule applies to its appliances is not determined
Ban Status
Not banned. Not named on the FCC Covered List
Manufacturing
Europe (per Deciso)
Models graded
Not yet
Security Verdict
OPNsense is open-source firewall software developed by Deciso, a privately held Dutch company that also sells appliances made in Europe. It ships minor updates about every two weeks and two major releases a year. It published several critical-rated flaws in 2025 and 2026, mostly requiring an authenticated user, and none are on CISA's exploited list. Updates are applied by the administrator.
Bottom line: OPNsense fixes flaws quickly and has no actively exploited flaws on CISA's list. Its safety depends on an administrator installing updates and keeping the admin interface locked down.
From the team behind this checker
Weighing up OPNsense? See the router that scores an A on this same method.
- SecureRooms. Smart devices live apart from your computers.
- You approve every new device before it joins.
- Rio VPN built in. First year included.
- Set up in about 10 minutes from the app.
$199.99 · 1 year of VPN included, then $7.99/mo · 30-day returns · 1-year warranty. Rio builds this site, and its router is graded by the same method as every other.
Corporate Ownership Structure
Deciso B.V. is a private company in Middelharnis, the Netherlands, with a sales entity named Deciso Sales B.V. It develops OPNsense, which forked from pfSense in 2015. Its owners are not disclosed in public sources.
Key Risk Factors
Several critical-rated flaws in 2026
CVE-2026-45158, CVE-2026-44193 and CVE-2026-53581 (CVSS 9.0 to 9.1) were published in 2026. Fixes shipped in 26.1.7 through 26.1.9.
Updates applied by the administrator
Per the OPNsense docs, updates are installed by the administrator under System > Firmware.
Frequent, scheduled releases
OPNsense ships two major releases a year (January and July) with minor updates about every two weeks, and publishes advisories through GitHub and release notes.
No flaws on CISA's exploited list
No OPNsense or Deciso vulnerability is in the CISA Known Exploited Vulnerabilities catalog as of October 2026, and no botnet or state-actor reports were found.
Known CVEs - OPNsense Routers
The following vulnerabilities from the NIST National Vulnerability Database affect OPNsense router models. This is a representative sample; the full CVE list may be longer.
CVE-2026-45158
Critical (CVSS 9.1)
Unsanitized input to the DHCP configuration allows code execution as root, fixed in 26.1.8.
CVE-2026-44193
Critical (CVSS 9.1)
Flaw in the XMLRPC restore method, fixed in 26.1.7.
CVE-2026-53581
Critical (CVSS 9)
Path traversal in the NTP configuration, fixed in 26.1.9.
CVE-2025-50989
Critical (CVSS 9.1)
Authenticated command injection when editing bridge interfaces, fixed in 25.1.8.
Frequently Asked Questions
OPNsense has a fast release schedule, a full-disclosure security policy, and no vulnerabilities on CISA's exploited list. It has had several critical-rated flaws in 2025 and 2026, mostly needing an authenticated user, and each was fixed in a regular update. Keep it updated and limit who can reach the admin interface.
Deciso B.V., a privately held company in Middelharnis, the Netherlands. OPNsense is an open-source, FreeBSD-based firewall that forked from pfSense in 2015. Deciso's owners are not publicly disclosed.
OPNsense ships two major releases a year, in January and July, with minor updates about every two weeks. The support period for each release series is not publicly stated.
Deciso is not on the FCC Covered List and holds no Conditional Approval. Its appliances are produced in Europe, but whether firewall appliances count as consumer routers under the March 2026 rule is not determined. OPNsense installed on your own hardware is software, not a covered device.
Deciso's shop says its DEC700 appliances are designed, made and shipped from Europe, with Dutch design. The specific factory is not publicly confirmed.
Sources
Facts on this page come from these sources (publish date, or the date we checked the page).
- OPNsense - Wikipedia (accessed 2026-10-07)
- OPNsense Shop: DEC700 series (accessed 2026-10-07)
- OPNsense docs: Updates (accessed 2026-10-07)
- OPNsense Roadmap (accessed 2026-10-07)
- OPNsense Security (accessed 2026-10-07)
- NVD CVE-2026-45158 (2026-05-13)
- NVD CVE-2026-53581 (2026-09-08)
- FCC Covered List (incl. router Conditional Approvals table) (accessed 2026-10-07)
- FCC FAQ: Covered List and routers produced in foreign countries (updated 2026-05-12)
- CISA Known Exploited Vulnerabilities catalog (JSON feed v2026.10.04) (2026-10-04)
CHECK YOUR SPECIFIC MODEL
Get your router's full security report
Check any specific model for CVEs, FCC status, security capabilities, and your personalized action plan.
Check a Router → Top 10 Safe Routers