Advisory · CVE-2026-111217
pfSense CARP virtual IP identifier can inject shell commands as root
An OS command injection flaw in pfSense CE through 2.9.0 lets a user with Virtual IP edit privilege store a CARP VHID containing shell metacharacters, which executes through ifconfig calls or CARP status rendering. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
- Vendor
- Netgate
- Product
- pfSense CE
- Identifier / CWE
- CVE-2026-111217
CWE-78 - Action timing
- Immediate
Explain it like I’m five
The VHID should be a small number. Because it is not validated, it can carry shell syntax that the firewall later runs while configuring or displaying the virtual IP.
- 01Privileged user edits a virtual IP
An authenticated user with Virtual IP edit privilege saves a CARP VHID containing shell metacharacters.
- 02VHID stored unchecked
The malicious value persists in the configuration.
- 03Firewall uses the VHID
Applying the virtual IP or rendering CARP status interpolates the VHID into shell commands.
- 04Commands run as root
The injected commands execute with root privileges.
What happened
Disclosure records published October 15, 2026 describe an OS command injection vulnerability (CWE-78) in Netgate pfSense CE through 2.9.0. An unvalidated CARP VHID supplied through Virtual IP settings reaches ifconfig calls during interface configuration and a status helper when CARP status is rendered.
The score comes from the CVSS 4.0 assessment (8.6) in the disclosure record; the CVSS 3.1 assessment in the same record is 7.2 because the attacker must already hold a privileged WebGUI account. Treat this as an admin-account containment issue: it matters most where WebGUI privileges are shared, stale, or broader than intended.
What to do
- Inventory pfSense CE firewalls and confirm each one’s version against the affected range in the vendor-side record above.
- Apply the Netgate fix or upgrade for this issue as soon as a fixed release or patch is available, and use the System Patches mechanism where Netgate directs.
- Restrict WebGUI access to a dedicated management network and named admin accounts while remediation is underway.
- Audit the configuration and logs for CARP VHID values that are not plain numbers and virtual IP changes followed by unexpected processes.
- Review admin and read-only accounts, remove stale ones, and rotate credentials for any account that could have used this path.
- Verify the firewall version or patch state after remediation.
Management note
High-availability fields are easy to overlook in reviews because they look like plumbing. On a firewall, plumbing runs as root; validate it like it does.