CVE-2026-111218 Netgate CVE debrief

Who should care

Defenders responsible for Netgate pfSense CE systems, especially those with Traffic Shaper Limiters privileges, should assess exposure and prioritize patching or mitigation. This includes reviewing system versions, user privileges, and potential impact on Traffic Shaper Limiters. Additionally, defenders should monitor system logs for suspicious activity and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-111218 is a high-severity OS command injection vulnerability in Netgate pfSense CE versions 2.7.0 through 2.9.0. Authenticated users with Traffic Shaper Limiters privileges can execute root commands, potentially leading to system compromise and lateral movement.

• Execution of arbitrary commands as root
• Potential for lateral movement and privilege escalation
• Compromise of system integrity and confidentiality

Technical summary

The vulnerability is caused by improper sanitization of user input in the limiter number field, allowing authenticated users with Traffic Shaper Limiters privileges to execute root commands. This can be achieved by submitting a malicious hidden 'number' value when editing a limiter, then deleting it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root. The vulnerability has a CVSS score of 8.6, indicating a high-severity level. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those with Traffic Shaper Limiters privileges.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those with Traffic Shaper Limiters privileges.

Recommended defensive actions

• Verify exposure by checking system versions and user privileges
• Assess the impact of the vulnerability on Traffic Shaper Limiters
• Apply patches or mitigations provided by the vendor
• Monitor system logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. This is a high-severity vulnerability with a CVSS score of 8.6.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.