Recommended action window: Monitor and triage in normal cycle
NVD description
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🎯 Most likely to be exploited next (EPSS): • CVE-2026-111214 — EPSS 10% · CVSS 8.6 • CVE-2026-111218 — EPSS 8% · CVSS 8.6 • CVE-2026-111217 — EPSS 6.7% · CVSS 8.6 📄 Full weekly tables → https://github.com/notcve/reports/blob/main/weekly/2026-10-22.md
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pfsense | pfsense | - | - | - |