pfrest vulnerabilities

Products

• pfSense-pkg-RESTAPI 1

Latest pfrest CVEs

Newest publication first

1. CVE-2026-113779 pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission

   Published 2026-10-21

   High·CVSS 8.8 EPSS 0.41%

   The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permissi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.