CVE-2026-111231

7.2High

Published 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-863

Impact

Authenticated WebGUI users with read-only access can gain root code execution across reboots. Attackers need existing high-privilege read access to backup or restore pages like diag_backup.php or services_acb.php.

Root cause

The config_restore() and config_install() functions fail to enforce the 'User - Config: Deny Config Write' privilege, letting restricted users overwrite config.xml.

Affected systems

Netgate pfSense CE through 2.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade past pfSense CE 2.9.0 when a patch is released. As an interim workaround, revoke WebGUI permissions for services_acb.php, uploadconfig.php, diag_confbak.php, and diag_backup.php from all non-admin users.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111231