---
id: CVE-2026-111224
title: >-
  pfSense CE through 2.9.0 contains an OS command injection vulnerability in the
  OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to
  execute commands as root via crafted usernames
summary: >-
  pfSense CE through 2.9.0 contains an OS command injection vulnerability in the
  OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to
  execute commands as root via crafted usernames. Attackers authenticated
  through…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: Netgate
product: pfSense CE
affected:
  - pfsense_ce <= 2.9.0
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:35.090'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111224'
references:
  - url: 'https://abraxaslabs.tech/research/pfsense-ce-leftovers'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/abraxas/pfsense-ovpn-connect-eval'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/sbin/openvpn.connect_async.sh#L83-L114
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-openvpn-connect-async-sh
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T19:25:46.429Z'
---

## Overview

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.