CVE-2026-111225

HIGH 8.8CVE-2026-111225 · Published 15/10/2026 · updated 19/10/2026

In short

CVE-2026-111225 is a HIGH (CVSS 8.8) vulnerability affecting pfsense (pfsense).
Chance of exploitation in the next 30 days (EPSS): 6.2%, higher than 93.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
pfsense pfsense	`≥ 2.5.0, ≤ 2.9.0`	No fix yet

Description

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.

References

abraxaslabs.tech/research/pfsense-ce-leftovers · Issue Tracking
abraxas/pfsense-ovpn-learn-cn · Third Party Advisory
pfsense/pfsense · Product
vulncheck.com/advisories/netgate-pfsense-ce-2.5.0-through-2.9.0-os-command-injection-via-openvpn-learn-address-sh · Third Party Advisory

More vulnerabilities in pfsense

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pfsense

≥ 2.5.0, ≤ 2.9.0

No fix yet

Description

More vulnerabilities in pfsense

See all →