CVE-2026-111224: Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh

Q: Which authentication setups are exposed?

The issue affects OpenVPN users authenticated through RADIUS or LDAP. An attacker must be able to authenticate as a VPN user with a crafted username containing single quotes and shell metacharacters.

Q: What level of access can exploitation provide?

Successful exploitation allows command execution as root. The injection can be triggered during VPN connection or disconnection through the OpenVPN script's handling of the pfctl anchor name.

Q: What versions are identified as affected?

pfSense CE through version 2.9.0 is identified as affected.

Published Oct 15, 2026

Updated

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connectasync.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.

Affected Software

1 affected component

Netgate pfSense CE<=2.9.0

Event History

Oct 15, 2026

CVE Published

via MITRE·06:46 PM

Data Sourced

via MITRE·06:46 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which authentication setups are exposed?

The issue affects OpenVPN users authenticated through RADIUS or LDAP. An attacker must be able to authenticate as a VPN user with a crafted username containing single quotes and shell metacharacters.

What level of access can exploitation provide?

Successful exploitation allows command execution as root. The injection can be triggered during VPN connection or disconnection through the OpenVPN script's handling of the pfctl anchor name.

What versions are identified as affected?