Skip to content
High-Risk Authorization Bypass in Netgate pfSense CE

High-Risk Authorization Bypass in Netgate pfSense CE

First seen 16 Oct 2026, 02:36 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 16, 2026 at 03:38 UTC
  • •CVE-2026-111231 allows unauthorized config.xml replacement in pfSense CE.
  • •Affected versions include pfSense CE through 2.9.0; CVSS score is 8.6.
  • •Organizations with remote WebGUI access are at high risk of exploitation.

Netgate pfSense CE versions up to 2.9.0 contain an authorization bypass vulnerability (CVE-2026-111231) that allows read-only WebGUI users to replace the config.xml file. This flaw arises because the config_restore() and config_install() functions ignore the 'User – Config: Deny Config Write' privilege. Attackers with access to specific pages can exploit this to gain root-level code execution upon a system reload or reboot. Organizations with internet-reachable firewall management interfaces are particularly at risk. The vulnerability has a CVSS score of 8.6, indicating high severity, but there is currently no confirmed exploitation in the wild. Administrators are advised to review WebGUI access logs and restrict access to trusted networks while awaiting a vendor patch.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-10-15
CVE-2026-111231 published
Netgate disclosed an authorization bypass vulnerability affecting pfSense CE versions up to 2.9.0.
Redpacketsecurity

More articles in this cluster (4)

Following this threat?

Track CVE-2026-111231 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

What versions of pfSense are affected?
All versions of pfSense CE through 2.9.0 are affected by this vulnerability.
Is there any confirmed exploitation of this vulnerability?
No confirmed exploitation has been reported as of now.
What should organizations do to mitigate this risk?
Organizations should restrict WebGUI access to trusted networks and review access logs for suspicious activity.