ZDI-CAN-32353: ZDI-26-960: Netgate pfSense CE XMLRPC Incorrect Authorization Remote Code Execution Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netgate pfSense. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92182.

Affected Software

1 affected component

Netgate pfSense CE

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must authenticate to the affected pfSense CE installation. The provided information does not identify which authenticated role or privileges are required.

What is the potential impact after successful exploitation?

A successful attacker can execute arbitrary code on the affected Netgate pfSense CE installation. The advisory assigns a CVSS score of 8.8.

ZDI-CAN-32353: ZDI-26-960: Netgate pfSense CE XMLRPC Incorrect Authorization Remote Code Execution Vulnerability

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact after successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact after successful exploitation?