Home › pfSense
pfSense: which version is safe to update to?
Firewall and router software, available as pfSense Plus and pfSense CE. Every release below is checked against official notes, NVD CVE data and public community reports.
All recent releases
CE 2.9.0 4 CVEs
Problems reported
Plus 26.07 5 CVEs
Problems reported
Plus 26.03.1
No problems reported
Plus 26.03
No widespread problems
Plus 25.11.1
No widespread problems
Plus 25.11
No widespread problems
CE 2.8.1 1 CVE
Not checked yet
Plus 25.07.1
Not checked yet
Plus 25.07
Not checked yet
Recent CVEs (last 120 days)
- CVE-2026-111214 HIGH 8.6 Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers c…
- CVE-2026-111215 HIGH 8.6 Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited W…
- CVE-2026-111216 HIGH 8.6 Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 lin…
- CVE-2026-111217 HIGH 8.6 Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers…
- CVE-2026-111218 HIGH 8.6 Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number…
- CVE-2026-111220 HIGH 8.6 pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute field…
- CVE-2026-111223 HIGH 8.6 Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can…
- CVE-2026-111226 HIGH 8.6 pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attack…
The weekly "safe to update?" email
One short email a week: what shipped, what broke, and what's safe to install. No spam.
Thanks — you're on the list.
We store only your email address and the date you signed up, to send this newsletter. We never sell or share it. Every email will have a one-click unsubscribe; you can also ask us to delete your address at any time. Privacy details.