{"id":"CVE-2026-111226","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-111226","generatedAt":"2026-10-28T01:12:03.977Z","title":"pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings.","description":"pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.","published":"2026-10-15T19:17:35.000Z","lastModified":"2026-10-26T16:17:14.000Z","status":"Awaiting Analysis","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.6,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-78"],"affected":[],"epss":{"score":0.06548,"percentile":0.93761,"date":"2026-10-26","history":[{"date":"2026-10-16","score":0.06548,"percentile":0.93727}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (6.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-15T19:17:35.000Z","detail":{"score":"8.6","severity":"HIGH","publishedAt":"2026-10-15T19:17:35.373Z"},"summary":"New CVE, high severity (CVSS 8.6)."}],"references":[{"url":"https://abraxaslabs.tech/research/pfsense-ce-leftovers","source":"disclosure@vulncheck.com"},{"url":"https://github.com/abraxas/pfsense-sshguard-crlf","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/syslog.inc#L531-L563","source":"disclosure@vulncheck.com"},{"url":"https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/system_advanced_admin.inc#L355-L381","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.4.5-through-2.9.0-os-command-injection-via-system-advanced-admin-php","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111226","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}