27
CVEs
0
Critical
16
High
0
KEV
21
PoC
14
Unpatched C/H
22.2%
Patch Rate
2.8%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
16
MEDIUM
9
LOW
2
Monthly CVE Trend
Affected Products (30)
PHP
47
Pfsense
42
Pfsense Ce
29
Pfsense Plus
14
Open Redirect
2
Pfblockerng
2
Suricata
2
Suricata Package
2
Apcupsd
2
Freebsd
2
Debian Linux
2
Snort Package
2
Erlang
1
Opnsense
1
Xshell 7
1
Paramiko
1
Pkixssh
1
Transmit 5
1
Openshift Container Platform
1
Node.js
1
Sshlib
1
Pfsense Pkg Frr
1
Net Ssh
1
Ssh Server
1
Securecrt
1
Openshift Virtualization
1
Ssh2
1
Lcos Fx
1
Java
1
Libssh
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-111214 | OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 allows an authenticated web-interface user who holds the QinQ edit privilege to execute arbitrary commands as root. The attacker saves a crafted parent interface ('if') value and then re-edits the QinQ entry, causing that unvalidated value to be interpolated into an ifconfig shell command; publicly available exploit code exists, and no confirmed active exploitation (CISA KEV) has been reported. The principal constraint is the high privilege requirement - only operators already trusted with interface configuration can reach the vulnerable code path - and risk is further reduced where the management UI is not exposed to untrusted networks or lower-privileged users. | HIGH | 8.6 | 8.6% | 72 |
PoC
No patch
|
| CVE-2026-111218 | OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated web GUI user who holds the Traffic Shaper Limiters privilege execute arbitrary commands as root, turning a narrowly delegated configuration permission into full appliance compromise. The flaw is triggered when an operator edits a limiter and injects a crafted hidden 'number' value and then deletes that limiter, causing delete_queue() to pass the unquoted, attacker-controlled value to dnctl via /bin/sh running as root. Publicly available exploit code exists (VulnCheck advisory plus Abraxas Labs research and a PoC repository), and while the issue is not listed in CISA KEV as actively exploited, exploitation is gated on prior authenticated access with the Limiters privilege (PR:H) and on the attacker completing the limiter edit-then-delete workflow. | HIGH | 8.6 | 8.4% | 71 |
PoC
No patch
|
| CVE-2026-111215 | Command injection in Netgate pfSense CE through 2.9.0 allows remote authenticated users with limited 'Wireless Edit' or 'Interface Assignments' GUI privileges to execute arbitrary commands as root. The flaw is triggered by supplying a crafted wireless parent interface name such as ath0;<cmd> through interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command. Publicly available exploit code exists, and the assessed impact is high for confidentiality, integrity, and availability, though exploitation requires valid credentials with one of those specific privileges and access to the management interface. | HIGH | 8.6 | 7.1% | 70 |
PoC
No patch
|
| CVE-2026-111217 | Command injection in Netgate pfSense CE through 2.9.0 allows an authenticated user with Virtual IP (CARP) edit privileges to execute commands as root by storing a malicious VHID value that is later interpolated into ifconfig calls or CARP status rendering. Publicly available exploit code exists, and the independent assessment rates this as a privilege-gated high-impact issue rather than an unauthenticated remote compromise; CISA KEV does not confirm active exploitation in the supplied data. Affected deployments are those where administrators or delegated operators can create or modify CARP VIPs, narrowing realistic risk to insiders or attackers who already hold privileged firewall UI access. | HIGH | 8.6 | 7.1% | 70 |
PoC
No patch
|
| CVE-2026-111216 | OS command injection in Netgate pfSense CE (through 2.9.0) allows remote attackers holding an authenticated web-GUI account with gateway edit privileges to execute arbitrary commands as root by planting shell metacharacters in the zone index of an IPv6 link-local gateway Monitor IP, which start_dpinger() passes unescaped into the dpinger shell command when gateway monitoring is applied. Exploitation requires high privileges (CVSS 4.0 PR:H) and no victim interaction (UI:N), but yields high confidentiality, integrity and availability impact on the firewall itself; publicly available exploit code exists (abraxas/pfsense-gw-ipv6-zone) with no confirmed active exploitation reported. This is a genuine but access-gated priority: unauthenticated or low-privileged users cannot reach the vulnerable gateway-edit path, so exposure is limited to deployments where such configuration rights are delegated. | HIGH | 8.6 | 6.5% | 70 |
PoC
No patch
|
| CVE-2026-111226 | Command injection in Netgate pfSense CE 2.4.5 through 2.9.0 lets an authenticated WebGUI user holding the Advanced Admin Access privilege execute arbitrary commands as root by placing newline or $(...) sequences in the Login Protection (sshguard) threshold, block time, or detection time fields, which are written unvalidated to sshguard.conf and sourced as root when the service restarts. The flaw is privilege-gated rather than mass-exploitable: the CVSS vector specifies PR:H, so only already-administrative accounts can trigger it, with no user interaction required beyond the attacker's own session. Publicly available exploit code exists (referenced in the CVE record), and the root cause is CWE-78 OS command injection. | HIGH | 8.6 | 6.5% | 70 |
PoC
No patch
|
| CVE-2026-111229 | Command injection in pfSense CE 2.7.0 through 2.9.0 allows authenticated users who hold only the Captive Portal HA privilege to execute commands as root by manipulating backwardsyncip to point at an attacker-controlled XMLRPC server and returning connected_users entries with shell metacharacters in ip or mac fields. Exploitation is privilege-gated: it requires the specific Captive Portal HA WebGUI permission, use of Captive Portal high-availability sync, and the ability to influence the synced connected_users data. Publicly available exploit code exists, but no CISA KEV confirmed active exploitation is identified; this is a credible privilege-gated priority rather than a mass-exploitation emergency. | HIGH | 8.6 | 6.4% | 69 |
PoC
No patch
|
| CVE-2026-111231 | Authorization bypass in Netgate pfSense CE through 2.9.0 allows an authenticated WebGUI account that holds page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php to replace config.xml despite lacking the 'User - Config: Deny Config Write' privilege; the account can otherwise be read-only. Successful exploitation can yield root-level code execution after a configuration reload or reboot, and publicly available exploit code exists. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.6), reflecting a remote authenticated low-privilege attacker with high confidentiality, integrity, and availability impact. | HIGH | 8.6 | 0.9% | 64 |
PoC
No patch
|
| CVE-2026-111224 | Authenticated VPN users can execute arbitrary commands as root on pfSense CE through 2.9.0 by exploiting an OS command injection in the OpenVPN connect/disconnect script, openvpn.connect_async.sh. The attack requires a valid VPN account authenticated via RADIUS or LDAP and a username containing single quotes and shell metacharacters that break out of an eval'd pfctl anchor name. Publicly available exploit code exists (reported by VulnCheck), though no active exploitation has been confirmed by CISA KEV. This is a credible high-priority issue for any pfSense CE deployment that uses OpenVPN with external authentication. | HIGH | 7.7 | 5.4% | 64 |
PoC
No patch
|
| CVE-2026-111223 | Command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated administrator who holds IPsec Mobile configuration privileges store a crafted single-line login banner that escapes the unquoted strongswan.conf attr value and injects charon.start-scripts entries, resulting in command execution as root on the firewall. Exploitation is gated by high privilege (PR:H) and by a charon restart precondition - the injected payload only runs when the strongSwan daemon is restarted, not at submission time - but publicly available exploit code exists and the impact on confidentiality, integrity, and availability is high. This is a genuine high-priority issue for organizations running affected pfSense CE firewalls, but its exploitation is gated by privilege rather than exposure, and no unauthenticated or unprivileged path has been identified. | HIGH | 8.6 | 0.8% | 64 |
PoC
|
| CVE-2026-97730 | PHP code execution on Netgate pfSense Plus and pfSense CE firewalls can be achieved by an authenticated, highly privileged webGUI user who can modify Dashboard widget settings and plant a crafted .widget.php file on the filesystem, then set a widget sequence value containing path traversal so Dashboard index.php include()s and executes that file. The vendor rates this High (CVSS 8.5), while the independent assessment keeps AV:N/AC:H but raises the privilege requirement to PR:H, reflecting that the attacker already needs substantial Dashboard and file-write access; it is not remotely exploitable without authentication. No public exploit or KEV-listed active exploitation was identified in the provided data, and Netgate has released fixed versions. | HIGH | 8.5 | 1.0% | 64 |
PoC
|
| CVE-2026-111220 | Root command execution on pfSense CE through 2.9.0 is achievable by authenticated attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege, who inject newline characters into the ptpid or PPP periodic-reset hour/minute fields of interfaces_ppps_edit.php. The injected newlines are written unescaped into /etc/crontab by configure_cron(), causing scheduled root command execution. Publicly available exploit code exists; CISA KEV does not list this CVE, and no public exploit activity has been confirmed. CVSS 4.0 score is 8.6 (PR:H), and an independent assessment concurs with high impact but notes this is a credentialed privilege-escalation-to-root flaw rather than a pre-auth mass-exploitation threat. | HIGH | 8.6 | 0.7% | 63 |
PoC
No patch
|
| CVE-2026-111222 | Authenticated pfSense CE administrators with General Setup privileges can achieve root-level PHP code execution by injecting an auto_prepend_file directive into php.ini through an unvalidated timezone value. Publicly available exploit code exists, but exploitation is conditional: the injected directive only runs after php.ini is regenerated at boot or on a php-fpm restart, and the attacker already holds administrator-equivalent access, making this a post-authentication privilege escalation rather than an unauthenticated remote compromise or mass-exploitation threat. Netgate pfSense CE through 2.9.0 is affected. | HIGH | 7.5 | 1.0% | 58 |
PoC
No patch
|
| CVE-2026-111221 | Authenticated pfSense CE WebGUI users holding L2TP Server or PPPoE Server edit privileges can inject mpd5 commands - including an up-script that executes as root - by submitting a RADIUS shared secret that contains a quote and newline. The weakness affects pfSense CE through 2.9.0 and requires a RADIUS-backed VPN configuration that actually starts a session for execution; publicly available exploit code exists, but CISA KEV does not list this CVE and no confirmed active exploitation has been reported. This is a genuine but access-gated code execution issue rather than a mass-exploitation threat. | HIGH | 7.5 | 1.0% | 58 |
PoC
No patch
|
| CVE-2026-111219 | Command injection in pfSense CE through 2.9.0 allows authenticated users with the PPPoE Server Edit privilege to inject newline characters into the username field, causing mpd5 to run arbitrary commands as root when a PPPoE client authenticates. The flaw resides in services_pppoe_edit.php, which fails to sanitize the username POST field (CWE-93). Public exploit code exists, but exploitation requires an enabled PPPoE server and a subsequent client authentication event, limiting this to a post-authentication privilege-escalation attack. | HIGH | 7.5 | 0.9% | 58 |
PoC
No patch
|