CVE-2026-111226 — Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as …
Published: 2026-10-15 · CVSS: 8.6 · CVSS 4.0
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7