CVE-2026-111231

Published 15 October 2026 · tracked since 16 October 2026

Description

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uplo

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2025-61624
• CVE-2026-111284 MEDIUM 5.4
• CVE-2026-110917 MEDIUM 4.3
• CVE-2026-110919 HIGH 8.8
• CVE-2026-110920 HIGH 8.8
• CVE-2026-110921 HIGH 8.8
• CVE-2026-110922 HIGH 8.8
• CVE-2026-110913 HIGH 8.8
• CVE-2026-110914 HIGH 8.8
• CVE-2026-110915 HIGH 8.8

→ Open the live CVE board · all tools