CVE-2026-111226

HighCVSS 7.2/10Last modified Oct 15, 2026

Description

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Netgate	pfSense CE	>= 2.4.5, <= 2.9.0

References

Timeline

Published: Oct 15, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1112275.5Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with t CVE-2026-1112285.5Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticat CVE-2026-1112297.2pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only t CVE-2026-111236.5Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fro CVE-2026-1112304.9Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read fi CVE-2026-1112317.2Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml bec CVE-2026-1112324.8Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: R CVE-2026-1112336.1Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote atta CVE-2026-1112345.9SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:/CVE-2026-1112359.1An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Secur CVE-2026-1112375.3A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_CVE-2026-111248.8Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a craf