CVE-2026-111224

Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh

7.7 High

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

5.37%Unchanged since Oct 16, 2026

What each source reports

CVE List Score used 7.7

Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh

Record: CVE-2026-111224
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2026-102336 7.7

Record: EUVD-2026-102336
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-x2xf-vqvc-49xv 7.7

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn...

Record: GHSA-x2xf-vqvc-49xv
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

NVD 7.7

Record: CVE-2026-111224
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

Affected products

netgate pfsense ce

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-111224 is a high vulnerability (CVSS 7.7) in Netgate Pfsense Ce, published October 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.37%, the 92nd percentile. No source names a fixed version.