pfSense security advisories, October 2026

pfSense advisories published in October 2026

1. Oct 21, 2026
   High [CVE-2026-113779] The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls

   High8.8

2. Oct 15, 2026
   High [CVE-2026-111231] Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore and config_install ignore the 'User - Config: Deny Config Write' privilege

   High8.6

3. Oct 15, 2026
   High [CVE-2026-111229] pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root

   High8.6

4. Oct 15, 2026
   High [CVE-2026-111226] pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings

   High8.6

5. Oct 15, 2026
   High [CVE-2026-111224] pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames

   High7.7

6. Oct 15, 2026
   High [CVE-2026-111223] Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field

   High8.6

7. Oct 15, 2026
   High [CVE-2026-111222] Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value

   High7.5

8. Oct 15, 2026
   High [CVE-2026-111221] Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret

   High7.5

9. Oct 15, 2026
   High [CVE-2026-111220] pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields

   High8.6

10. Oct 15, 2026
    High [CVE-2026-111219] Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields

    High7.5

11. Oct 15, 2026
    High [CVE-2026-111218] Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field

    High8.6

12. Oct 15, 2026
    High [CVE-2026-111217] Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID

    High8.6

13. Oct 15, 2026
    High [CVE-2026-111216] Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index

    High8.6

14. Oct 15, 2026
    High [CVE-2026-111215] Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name

    High8.6

15. Oct 15, 2026
    High [CVE-2026-111214] Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name

    High8.6

16. Oct 15, 2026
    High [CVE-2026-110908] pfSense Plus: Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter

    High8.8

17. Oct 15, 2026
    Medium [CVE-2026-111232] Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field

    Medium4.8

18. Oct 15, 2026
    Medium [CVE-2026-111230] Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php

    Medium6.9

19. Oct 15, 2026
    Medium [CVE-2026-111228] Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives

    Medium5.1

20. Oct 15, 2026
    Medium [CVE-2026-111227] Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives

    Medium5.1

21. Oct 15, 2026
    Low [CVE-2026-111233] Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter

    Low2.3

22. Oct 15, 2026
    Low [CVE-2026-111225] Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user

    Low2.3