High priorityDisclosed

Advisory · CVE-2026-111229

pfSense captive portal HA sync value can inject commands into pfctl operations

A command injection flaw in pfSense CE 2.7.0 through 2.9.0 in captive portal high-availability sync handling lets a privileged user inject shell commands that reach pfctl operations. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).

Advisory published October 15, 2026Independent summary
Vendor
Netgate
Product
pfSense CE
Identifier / CWE
CVE-2026-111229
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

A value used to keep two firewalls in sync is folded into shell commands for the packet filter, so the sync channel becomes a command channel.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Privileged user edits HA sync

    An authenticated user with captive portal HA sync access saves a crafted value.

  2. 02Value stored unchecked

    The unvalidated value persists in the captive portal configuration.

  3. 03pfctl command built

    HA sync handling interpolates the value into shell commands that drive pfctl.

  4. 04Commands run as root

    The injected commands execute with root privileges on the firewall.

What happened

Disclosure records published October 15, 2026 describe a command injection vulnerability (CWE-78) in Netgate pfSense CE 2.7.0 through 2.9.0 affecting captive portal high-availability synchronization. The crafted input reaches shell commands used with pfctl, the packet-filter control tool.

The score comes from the CVSS 4.0 assessment (8.6) in the disclosure record; the CVSS 3.1 assessment in the same record is 7.2 because the attacker must already hold a privileged WebGUI account. Treat this as an admin-account containment issue: it matters most where WebGUI privileges are shared, stale, or broader than intended.

What to do

  1. Inventory pfSense CE firewalls and confirm each one’s version against the affected range in the vendor-side record above.
  2. Apply the Netgate fix or upgrade for this issue as soon as a fixed release or patch is available, and use the System Patches mechanism where Netgate directs.
  3. Restrict WebGUI access to a dedicated management network and named admin accounts while remediation is underway.
  4. Audit the configuration and logs for captive portal HA sync settings containing shell metacharacters and unexpected pfctl activity.
  5. Review admin and read-only accounts, remove stale ones, and rotate credentials for any account that could have used this path.
  6. Verify the firewall version or patch state after remediation.

Management note

HA pairs replicate trust as well as configuration. A flaw in sync handling can compromise both members of the pair, so audit the standby unit too.