Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111218Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters

High 7.2

In plain English

A high-severity OS command injection in pfSense CE from Netgate. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 8.6% (higher than 95% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)8.6%top 4.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.

Affected products (as reported)

Vendor	Product	Versions
Netgate	pfSense CE	2.7.0 – through 2.9.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/abraxas/pfsense-limiter-number exploit, technical-description
https://abraxaslabs.tech/research/pfsense-ce-leftovers technical-description
https://abraxaslabs.tech/research/pfsense-limiter-number technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3959 technical-description
https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3820-L3821 technical-description
VulnCheck Advisory: Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters third-party-advisory