High severity · published Oct 15, 2026
CVE-2026-111226
Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
7.2
CVSS
6.5%
EPSS
No
On KEV
Description
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
pfSense CE · Netgate
2.4.5 through 2.9.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111226
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111226
abraxaslabs.tech
https://abraxaslabs.tech/research/pfsense-ce-leftovers
github.com
https://github.com/abraxas/pfsense-sshguard-crlf
github.com
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/syslog.inc#L531-L563
github.com
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/system_advanced_admin.inc#L355-L381
www.vulncheck.com
https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.4.5-through-2.9.0-os-command-injection-via-system-advanced-admin-php
More from pfSense CE
8.8
CVE-2026-111225
Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
8.8
CVE-2024-54780
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of…
8.5
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an…
7.5
CVE-2026-111224
Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh
7.2
CVE-2026-111231
Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()