-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-26_22.webgui Security Advisory pfSense Topic: Category: pfSense Base System Module: webgui Announced: 2026-09-15 Credits: Alex Williams from Pellera Technologies working with TrendAI Zero Day Initiative Affects: pfSense Plus software versions <= 26.07 pfSense CE software versions <= 2.9.0 Corrected: 2026-08-26 18:23:15 UTC 0. Revision History v1.0 2026-09-15 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description A potential authenticated arbitrary command execution vulnerability was found in xmlrpc.php when using remote authentication. If pfSense software is configured to perform remote authentication via LDAP/RADIUS for the system itself, then the privilege check in xmlrpc.php can improperly test privileges in certain cases. When xmlrpc.php attempts to check privileges it gathers account information via getUserEntry($username). This function returns an associative array that is missing the uid parameter if there is no matching local account. When checking privileges, a logic error causes this condition to not trigger the code that detects a lack of privileges to deny access. III. Impact The incorrect privilege check can allow a user with valid LDAP credentials, but no matching local account, to execute XMLRPC methods when they do not have the appropriate "system-xmlrpc-ha-sync" privilege. The available XMLRPC methods include exec_php which allows running arbitrary PHP code and by consequence, arbitrary shell commands. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Ensure every valid LDAP user has a matching local account entry. - -or- * Do not use remote authentication for the system itself. V. Solution Users can upgrade to the next available version of pfSense Plus software after version 26.07 when available, or pfSense CE software versions after 2.9.0 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus versions 26.10 and 26.03.1, or pfSense CE version 2.9.0 and 2.8.1 may apply the fix from the recommended patches list in the System Patches package after installing or updating the System Patches package. Users may also manually apply the relevant changes using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Revision - - ------------------------------------------------------------------------- 889905ba4db8e1b873da28ae115a10b9f0fd0b05 - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmqpht8ACgkQE7mH/ZIU +NqYqRAA0QBX8qqQ4SNkW82WdGiojt5K9ygRMcE+/koEYDLJqcbR2CRleGD0p17J KUTquS7MjVwwI5pxnxLZf3t4LKnQ3/e1xnXe4emKjTN7+6ckm8HXM8RTJROuwmXq OC22eMlLDcO7kx9fusO/9u1/2k21tqJ94dmuDXYA+nEQkIAubBXvAphY9FeVGlQ+ jQgHEO0HZp1fYTA+sTZgCBPmSDDpNZ3F8PZaDMnozm27OmS6hB33Mq6Y5kj+uRy4 rG3BXkWWoh58JdG/MCYpLfSH7oS+41ryRnpS8i1GnhnuxI08vbi1g8R/LxuM8DJQ sJSBSVfHhd67ZFuakSeJizVSN4K/qdZIIOcFMBqGqavn5dI7uj6HbZiEvy5oYiKn vf5x80T1StKx+ht17oi0E+fNINW5UkDvfQzySGfcmUHJnQdCjUZxzINMlxJSkBRR hjIJ4uWzhgvKh+2vAmvQoY1rbynqWyRQZCKJSjLFW+zROrCE51abdll9yCf3tkwp /Ieaxt0Q7SpsdsqBTVrKJeMq1y9+5ZBSq4Pzb/rsTUs/m3Lim+uCWkTp5dWbC7XN +9GQfAXoCKma7233M1cy9ycJFHpKlGAy02AR4HYRGO9/okxYj5mCGMkgoHZKrtra SctZaiqFlWUnjKYyMcaMqgqalhx3qLCEzsT1hcQwXuhFO9p1aj4= =Oyxm -----END PGP SIGNATURE-----