PatchTheCVEpfsense vulnerabilities and fixes
Recent CVEs affecting pfsense, with upgrade or downgrade steps. 16 tracked.
pfsense has 16 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 16. Most recent: 2026-10-15. Highest priority: CVE-2026-111217 (score 54/100).
- CVE-2026-111231 HIGH 7.2 UPGRADE Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI u
- CVE-2026-111221 MEDIUM 6.6 UPGRADE Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated We
- CVE-2026-111216 HIGH 7.2 UPGRADE Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated user
- CVE-2026-111232 MEDIUM 4.8 UPGRADE Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authen
- CVE-2026-111227 MEDIUM 5.5 UPGRADE Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that all
- CVE-2026-111222 MEDIUM 6.6 UPGRADE Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users wi
- CVE-2026-111217 HIGH 7.2 UPGRADE Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated user
- CVE-2026-111218 HIGH 7.2 UPGRADE Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticate
- CVE-2026-111219 MEDIUM 6.6 UPGRADE Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that al
- CVE-2026-111214 HIGH 7.2 UPGRADE Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticate
- CVE-2026-111215 HIGH 7.2 UPGRADE Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated user
- CVE-2026-111223 HIGH 7.2 UPGRADE Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authentica
- CVE-2026-111225 MEDIUM 5.0 UPGRADE Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address
- CVE-2026-111228 MEDIUM 5.5 UPGRADE Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanc
- CVE-2026-111230 MEDIUM 4.9 UPGRADE Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic D
- CVE-2026-111233 MEDIUM 4.7 UPGRADE Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rul
FAQ
How do I fix pfsense vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pfsense being exploited right now?
None of the tracked pfsense CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pfsense CVE should I patch first?
CVE-2026-111217 currently ranks highest (54/100): Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated user.