-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-26_22.webgui Security Advisory pfSense Topic: Category: pfSense Base System Module: webgui Announced: 2026-09-15 Credits: Alex Williams from Pellera Technologies working with TrendAI Zero Day Initiative CVE ID: CVE-2026-92182 Affects: pfSense Plus software versions <= 26.07 pfSense CE software versions <= 2.9.0 Corrected: 2026-08-26 18:23:15 UTC 0. Revision History v1.1 2026-09-21 Added CVE ID v1.0 2026-09-15 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description A potential authenticated arbitrary command execution vulnerability was found in xmlrpc.php when using remote authentication. If pfSense software is configured to perform remote authentication via LDAP/RADIUS for the system itself, then the privilege check in xmlrpc.php can improperly test privileges in certain cases. When xmlrpc.php attempts to check privileges it gathers account information via getUserEntry($username). This function returns an associative array that is missing the uid parameter if there is no matching local account. When checking privileges, a logic error causes this condition to not trigger the code that detects a lack of privileges to deny access. III. Impact The incorrect privilege check can allow a user with valid LDAP credentials, but no matching local account, to execute XMLRPC methods when they do not have the appropriate "system-xmlrpc-ha-sync" privilege. The available XMLRPC methods include exec_php which allows running arbitrary PHP code and by consequence, arbitrary shell commands. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: * Ensure every valid LDAP user has a matching local account entry. - -or- * Do not use remote authentication for the system itself. V. Solution Users can upgrade to the next available version of pfSense Plus software after version 26.07 when available, or pfSense CE software versions after 2.9.0 when available. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus versions 26.10 and 26.03.1, or pfSense CE version 2.9.0 and 2.8.1 may apply the fix from the recommended patches list in the System Patches package after installing or updating the System Patches package. Users may also manually apply the relevant changes using the System Patches package on earlier versions, or by manually making similar changes to the affected files if the patches do not apply directly. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Revision - - ------------------------------------------------------------------------- 889905ba4db8e1b873da28ae115a10b9f0fd0b05 - - ------------------------------------------------------------------------- VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmqxg0EACgkQE7mH/ZIU +Nr7iQ//SUht04au+1PflgEZZOCm5iVjD6chL2sTBReRxFHouC6YvJQFFURAYT8H 3MuSmwxk4wAPGTx69Etz1IuoQevv0SpVDJHvwlhToEu7o9uFXgdgsXvo492KregE LRejYf6PJMi97ZFS9McVzM8B6oz70BRQfK9lQ5TBcniIOdkzkI6ls3ReTodEq0gx FOcP+2Q0m/sId6JojrGKhvNt5eUXxZMC9RVDCxlenAE0LbTWtRqnK0x4diCwptZ0 7Cni2wkB37cFrcukUkC2+HFHxrNRB01NzF/OV1lD9eNAqOqWCZAqSk2g6IfzJlKu GrnXy+xWCExvfz9A41H+++8kHom14vPGr5ec5dr4XjvFrzRrcZIONzZXuQCJHGkt Qt45PV2KnmNAiaFKbIIno6g7BxTHA2FNtsYWWLVpSYfOCiCxFC+C0nm0MQ6apQst SusW/Ab+RU2LCUDi7x85OLQ38BF6XnRNRbpgMeRWzzeVaajYkFR5jDWD5zY1+hgp 4DtillMh+bnREZQ4oUBQKDDWhx9RFo22MnEBoWHfUQHm35SNDvNmpg8ukImQK0O6 rLhBO98DeUpXjQruPX8Nuifny8pEYTS2ua+BFo0oH5WBZWY8PZZUwZUjQldmhABF lqHOzZ5QsGfXVDdvcwBQqb+gXlsnzCw12C1BxwmlOCZv7TgwshA= =jsRq -----END PGP SIGNATURE-----