Advisory · CVE-2026-111226
pfSense login-protection settings can write shell payloads that run as root on restart
An OS command injection flaw in pfSense CE 2.4.5 through 2.9.0 lets a WebGUI user with Advanced Admin Access place newline or command-substitution payloads in sshguard settings, which are written to sshguard.conf and sourced as root on restart. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
- Vendor
- Netgate
- Product
- pfSense CE
- Identifier / CWE
- CVE-2026-111226
CWE-78 - Action timing
- Immediate
Explain it like I’m five
Numbers meant for login protection are written into a configuration file that a root process reads as shell, so a poisoned number becomes a command waiting for the next restart.
- 01Admin edits login protection
A WebGUI user with Advanced Admin Access submits crafted threshold, block time, or detection time values.
- 02Values written to config
The unvalidated values land in sshguard.conf.
- 03Service restarts
On restart, the configuration is sourced by a root process.
- 04Payload executes as root
The embedded newline or command substitution runs with root privileges.
What happened
Disclosure records published October 15, 2026 describe an OS command injection vulnerability (CWE-78) in Netgate pfSense CE 2.4.5 through 2.9.0. Login Protection values in Advanced Admin settings are written unvalidated to sshguard.conf and sourced as root when the service restarts.
The score comes from the CVSS 4.0 assessment (8.6) in the disclosure record; the CVSS 3.1 assessment in the same record is 7.2 because the attacker must already hold a privileged WebGUI account. Treat this as an admin-account containment issue: it matters most where WebGUI privileges are shared, stale, or broader than intended.
What to do
- Inventory pfSense CE firewalls and confirm each one’s version against the affected range in the vendor-side record above.
- Apply the Netgate fix or upgrade for this issue as soon as a fixed release or patch is available, and use the System Patches mechanism where Netgate directs.
- Restrict WebGUI access to a dedicated management network and named admin accounts while remediation is underway.
- Audit the configuration and logs for sshguard threshold, block time, or detection time values containing newlines or command substitution syntax.
- Review admin and read-only accounts, remove stale ones, and rotate credentials for any account that could have used this path.
- Verify the firewall version or patch state after remediation.
Management note
Persistence through a config file that only fires on restart is a nasty pattern: the change and the execution can be weeks apart. Diff sshguard settings against a known-good baseline.