CVE-2026-4748
Freebsd 14.0 – 14.4
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-4748 is a high-severity Use of Incorrect Operator (CWE-480) vulnerability in Freebsd Freebsd. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Service Stop (T1489); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-4748 is a vulnerability in the pf (packet filter) component of FreeBSD, arising from a regression in hash calculation for firewall rules. Rules using the address range syntax (x.x.x.x - y.y.y.y) that differ only in the address ranges are silently dropped as duplicates, with only the first such rule loaded into pf. Rules using the address[/mask-bits] syntax are unaffected. Certain action keywords on packet-matching rules, such as 'log', 'return ttl', or 'dnpipe', may experience the same issue, though such configurations are unlikely as they would be redundant. Affected rules are silently ignored, potentially causing unexpected behavior including over- and under-blocking. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWEs 480, 754, and 1023.
Remote attackers require only network access with no privileges, low attack complexity, and no user interaction to exploit this issue. By leveraging the silent dropping of intended firewall rules, attackers can achieve high confidentiality impact through under-blocking, allowing unauthorized access to sensitive data that administrators believed was protected. Over-blocking may also occur, but the primary risk is gaps in filtering leading to data exposure.
The FreeBSD Security Advisory at https://security.freebsd.org/advisories/FreeBSD-SA-26:09.pf.asc details mitigation steps for this vulnerability in pf.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17818
Vulnerability Data
A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually…
more
loaded into pf. Ranges expressed using the address[/mask-bits] syntax were not affected. Some keywords representing actions taken on a packet-matching rule, such as 'log', 'return tll', or 'dnpipe', may suffer from the same issue. It is unlikely that users have such configurations, as these rules would always be redundant. Affected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 7 hardening rules · 2 OS baselines
V6.3.4V6.3.5V6.1.3V6.5.7
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation will surface logic errors caused by an incorrect operator during code review or test execution.
Input validation directly requires checking for unexpected or malformed conditions before they propagate.
Mandating that access-control decisions apply the full set of required rules to each request structurally eliminates missing-factor comparisons.
Access enforcement requires that every authorization decision evaluate all relevant entity attributes, directly stopping incomplete comparisons from being used.
Security engineering principles include structured handling of edge cases and exceptions during design.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (reviews, static analysis, testing) directly catch incorrect-operator bugs while the weakness is only one narrow class of coding defect the control addresses.
Runtime monitoring of software and environments can detect adverse events triggered by unhandled exceptional conditions.
Authentication decisions often rely on multi-factor comparisons; incomplete comparisons directly weaken this control.
Enforcing access policy requires complete evaluation of all relevant attributes; missing factors undermine authorization decisions.
Generating logs of exceptions and errors enables detection of improper handling of unusual conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing and code review can catch operator errors before release.
Logging can record unhandled exceptions but does not prevent the weakness itself.
Monitoring may detect symptoms of unhandled conditions but does not eliminate the root weakness.
Secure development life cycle mandates exception handling and input validation that directly prevent missing checks for unusual conditions.
Application security requirements explicitly call for handling of exceptional conditions and error paths.
Secure system architecture and engineering principles require robust error and exception handling mechanisms.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248574 YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization. prevents CWE-754
- V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-754
Oracle Linux 9 (1 rule)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-754