CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner
Authenticated users with IPsec Mobile privileges can execute arbitrary commands as root by injecting code into the login banner configuration.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111223?
CVE-2026-111223 is a high-severity command injection vulnerability in Netgate pfSense CE, published on 15 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
Weakness: CWE-74
Which versions are affected by CVE-2026-111223?
It affects 1 product.
Products include Pfsense Pfsense.
How do I fix CVE-2026-111223?
No fix has been published for CVE-2026-111223 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-111223 being exploited?
There is no known exploitation of CVE-2026-111223 in the wild and no public exploit code.
Other vulnerabilities in Netgate pfSense CE
Sources
Also known as GHSA-743j-3p3m-6h73.