CVE-2026-111229 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync
Attackers with Captive Portal HA privileges can execute arbitrary commands as root via malicious XMLRPC responses in pfSense CE.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111229?
CVE-2026-111229 is a high-severity command injection vulnerability in Netgate pfSense CE, published on 15 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.
Weakness: CWE-78
Which versions are affected by CVE-2026-111229?
How do I fix CVE-2026-111229?
No fix has been published for CVE-2026-111229 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-111229 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111229 exists.
Sources
Also known as GHSA-xf3x-9wqm-925c.