CVE-2026-111216
HIGH
CVSS 7.2
Published: 2026-10-15
Modified: 2026-10-15
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.
Quick Facts
| CVE ID | CVE-2026-111216 |
| CVSS Score | 7.2 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Published | 2026-10-15 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |