CVE-2026-111226
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows…
- Risk score
- 62/100
- CVSS
- 7.2 v3.1
- Exploit chance (30 days)
- 6.5%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 7.2 high
- Exploitation likely: EPSS 6.5% (top 6%)
References
- https://abraxaslabs.tech/research/pfsense-ce-leftovers
- https://github.com/abraxas/pfsense-sshguard-crlf
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/syslog.inc#L531-L563
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/system_advanced_admin.inc#L355-L381
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.4.5-through-2.9.0-os-command-injection-via-system-advanced-admin-php
Original description
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
Last activity 15 Oct 2026. Patch Forecast updates every hour.