8.6

CVE-2026-111231: netgate pfsense ce Incorrect Authorization

CVSS: 8.6v4.0HighAnalyzed
Published 15-10-2026Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2026-111231 is a high (CVSS 8.6) Incorrect Authorization vulnerability in netgate pfsense ce. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.6/10
010
High · v4.0 (CVE.org)
EPSS score
0.83%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Timeline

  1. 15-10-2026
    PublishedVulnerability first disclosed.

Description

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.

CVSS metrics

4 scores · 2 sources · 2 versions

EPSS trend

Probability

0.83%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

16-10-202620-10-2026
EPSS score
0.83%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Pfsense Config Readonly Restore

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Netgate1 product
Pfsense1 product

2 vendors · 2 products

References

5 links