CVE-2026-111216 is a High severity (CVSS 7.2) OS command injection in pfSense CE through 2.9.0. A user with gateway edit rights can set a Monitor IP whose IPv6 zone runs commands as root. We found no fixed version, so limit who can edit gateways.
What's affected
The record says Netgate pfSense CE through 2.9.0 is affected. The researcher write-up says the review was of the public development tree for pfSense CE 2.9.0 at one commit, and notes that the PHP for the 2.9.0 release build was not on the public tree. We could not confirm whether shipped release builds contain the same code, and we found no Netgate advisory or fixed version, so check Netgate's channels.
The weakness is CWE-78, OS command injection. Per the record, an authenticated user with gateway edit privileges can set a gateway Monitor IP that includes an IPv6 link-local zone index. The zone is not validated. When monitoring is applied, start_dpinger() puts it unescaped into the dpinger shell command, which runs as root.
Severity differs by source. The record gives 7.2 (High), with high privileges required. VulnCheck lists 8.6 on a CVSS 4.0 vector. The record needs an authenticated account that can edit gateways, which is why the score is not higher.
How to check if you're exposed
Check your pfSense CE version in the web interface dashboard, or from the console menu.
cat /etc/version
Versions through 2.9.0 are in range per the record. The researcher's review was of development code, so a release you run may differ. Treat the exposure as depending on who holds WebGUI privileges.
Open System, User Manager, and list users and groups with their privileges. The case in the record is a limited user who was given the gateway editing pages. Admins already have wide control, so the new risk is for users with narrow grants. Also review who can reach the WebGUI at all. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Review WebGUI accounts and remove gateway editing privileges from anyone who does not need them.
- Limit WebGUI access to a management network or VPN with firewall rules, and never expose it on the WAN.
- Check Netgate announcements for a fix and install it when it is confirmed.
- Review gateway Monitor IP values for anything that contains unusual characters after an address.
- Turn on two factor authentication for WebGUI accounts if your setup supports it.
Why it matters
Firewall administrators are often treated as one trusted group, but pfSense lets you give a user a single page. A user with a narrow grant is not meant to be able to run commands as root. A shell command built from a stored setting breaks that boundary.
The pattern is a stored value that is trusted when read back later, by a different component than the one that saved it. Validating on input and escaping at the point of use both matter, because the value can be reused in contexts the form never thought about. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
Who can use this flaw?
Per the record, an authenticated WebGUI user with gateway edit privileges.
Is there a fixed version?
We found none. Check Netgate's advisories and release notes.
Sources
Last reviewed: 18 October 2026.
