CVE-2026-111226: Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-26
Weakness: CWE-78

Description

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.

Affected products

Netgate pfSense CE: from 2.4.5 through 2.9.0

References

https://abraxaslabs.tech/research/pfsense-ce-leftovers
https://github.com/abraxas/pfsense-sshguard-crlf
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/syslog.inc#L531-L563
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/system_advanced_admin.inc#L355-L381
https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.4.5-through-2.9.0-os-command-injection-via-system-advanced-admin-php

Get alerted when CVE-2026-111226 or the next vulnerability affects your stack