CVE-2026-111226 is a High severity (CVSS 7.2) OS command injection in pfSense CE 2.4.5 through 2.9.0. A WebGUI user with Advanced Admin Access can save Login Protection values that run commands as root on restart. We found no fixed version.
What's affected
The record says pfSense CE 2.4.5 through 2.9.0 is affected. The researcher write-up says the review was of the public development tree for pfSense CE 2.9.0 at one commit, and notes that the PHP for the 2.9.0 release build was not on the public tree. We could not confirm whether shipped release builds contain the same code, and we found no Netgate advisory or fixed version, so check Netgate's channels.
The weakness is CWE-78, OS command injection. Per the record, the Login Protection settings for the sshguard service accept a threshold, a block time and a detection time without validation. Values that contain newlines or command substitution are written into sshguard.conf, and that file is read by a shell as root when the service restarts.
Severity differs by source. The record gives 7.2 (High), with high privileges required. VulnCheck lists 8.6 on a CVSS 4.0 vector. The page privilege involved is Advanced Admin Access, which is broader than a single page grant, so many teams will see this as a smaller step up than the other pfSense issues in the same research.
How to check if you're exposed
Check your pfSense CE version.
cat /etc/version
Anything from 2.4.5 through 2.9.0 is in range per the record. Then open System, Advanced, Admin Access and look at the Login Protection fields. The threshold, block time and detection time should be plain numbers. Any other text is a sign of tampering.
Check which accounts hold the Advanced Admin Access privilege in the User Manager. Fewer is better. You can also compare the current sshguard configuration with a known good copy from a backup. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Correct the Login Protection values so each is a plain number, and check the configuration file after the restart.
- Remove Advanced Admin Access from accounts that do not need it.
- Limit the WebGUI to a management network or VPN. Do not expose it on the WAN.
- Install a Netgate fix when one is confirmed.
- Review administrative accounts and recent configuration changes for activity you did not expect.
Why it matters
Configuration files that are read by a shell are dangerous when any part of them comes from user input. A newline ends one assignment and starts another, and a command substitution runs when the file is sourced. The file looks like data but acts as code.
The fix is to validate each value as a number on input and to write the file with quoting that cannot be broken. Treat any generated file that a shell loads as code, and review its generator with that in mind. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
Which privilege is needed?
Per the record, the Advanced Admin Access privilege in the WebGUI.
When does the injected value run?
According to the record, when the sshguard service restarts and the configuration file is read by the shell as root.
Sources
Last reviewed: 18 October 2026.
