High severity · published Oct 15, 2026
CVE-2026-111224
Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh
7.5
CVSS
5.4%
EPSS
No
On KEV
Description
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.4% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
pfSense CE · Netgate
through 2.9.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111224
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111224
abraxaslabs.tech
https://abraxaslabs.tech/research/pfsense-ce-leftovers
github.com
https://github.com/abraxas/pfsense-ovpn-connect-eval
github.com
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/sbin/openvpn.connect_async.sh#L83-L114
www.vulncheck.com
https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-openvpn-connect-async-sh
More from pfSense CE
8.8
CVE-2026-111225
Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
8.8
CVE-2024-54780
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of…
8.5
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an…
7.2
CVE-2026-111231
Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()
7.2
CVE-2026-111229
Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync