CVE-2026-111226

7.2High

Published 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Authenticated admins with Advanced Admin Access can execute arbitrary OS commands as root. The attacker needs network access to the pfSense WebGUI and high-privilege credentials.

Root cause

The WebGUI writes unvalidated newline characters and command substitution syntax from sshguard Login Protection settings directly into sshguard.conf, which runs as root when the service restarts.

Affected systems

pfSense CE 2.4.5 through 2.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a fixed pfSense release beyond 2.9.0 once available. Until patched, restrict WebGUI access to trusted IPs and revoke the Advanced Admin Access privilege from all untrusted admin accounts.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111226