cyfenced.com →

[ CVE-2026-111229 · Published 15 Oct 2026 ]

Vulnerability in Netgate pfSense CE

CVSS 7.2 EPSS 6%1 agency advisoryNo fix listed yet

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

[ References ]References