Home › pfSense › Plus 26.07

pfSense Plus 26.07 – safe to update?

Security update: this release fixes security issues (highest CVSS 8.5). Waiting carries its own risk — if your device is exposed, weigh that against the reports below.

What's in this release

CVEs fixed

• CVE-2026-97730 HIGH 8.5 (NVD: fixed in this version)
  In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacke…
• CVE-2026-67189 MEDIUM 5.3 (NVD: fixed in this version)
  pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses a…
• CVE-2026-56126 MEDIUM 5.1 (NVD: fixed in this version)
  pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-rig…
• CVE-2026-56127 MEDIUM 5.1 (NVD: fixed in this version)
  pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML con…
• CVE-2026-56128 MEDIUM 5.1 (NVD: fixed in this version)
  pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitiz…

Community reports

• Problem Local hostname lookups seems broken in 26.07 · Reddit · 2026-09-29

  I have a Netgate running pfsense that has been working great until I updated it to 26.07. Apparently there was a change to the DHCP server. It now uses Kea instead of ISC, which has been deprecated, but is still selectable in Settings -> Advanced -> Networking. This somehow brok…

• Problem bus_dmamem_alloc failed to align memory properly · Reddit · 2026-09-28

  So I've been having connection issues lately, enough that I thought it must be pfSense because my modem had been fine for ages before. I looked into upgrading to an SSD finally and put it in my 2100 base model yesterday at which point I finished up and went to bed as it was late…

• Problem FRR OSPF routes not installed in main routing table after upgrade to 26.07 · Reddit · 2026-08-24

  I recently upgraded an old SG-4860-1U to 26.07. The upgrade seems to have completed successfully, but upon restart, none of the FRR OSPF routes were working. Status > FRR showed the OSPF routes fine, and the neighborship was FULL. The neighbors also received routes from PfSense…

• Problem Cannot update to 26.07 from 26.03.1 · Reddit · 2026-08-23

  Hi guys and girls, i'm trying to update to the new version but im seeing that My licence appears to be no loger valid and therefore i cant update. Is someone having the same issue ?. I havent changed hardware and i'm on the same netgate ID.

• Problem Higher CPU temperatures on 26.07 with an AMD CPU · Reddit · 2026-08-15

  After upgrading to pfSense Plus 26.07 on my custom box running an AMD Ryzen CPU, idle temperature increased from roughly 40C to 60-65C while the CPU was 99% idle. FreeBSD 16 enables the new hwpstate_amd CPPC support. On this system, every logical CPU showed desired_performance s…

• Fine So I upgraded to 26.07 after all · Reddit · 2026-08-17

  I was going to wait a couple of months; let thing gets ironed out a little bit. Then I figured out that you can upgrade to 26.07 and not use any of the new features exclusive to the Netgate Nexus controller. Not sure if everyone knows that? I used my Proxmox vm for that, tried t…

• Mention PfBlockerNG not removing de-selected countries from GEOIP Aliases · Reddit · 2026-10-15

  I use PFBlockerNG's GEOIP in Alias Native mode. I have Aliases for each country and I select/deselect countries as necessary. The problem is, de-selected countries' prefixes are still being added to the Alias. I've done a PFBlockerNG "Reload" and a PfSense Filter Reload, no chan…

• Mention KEA DHCP still isn't ready. · Reddit · 2026-09-15

  Sigh. Been having connection issues for weeks. Finally take the time to try to resolve it and sign in to the firewall and the admin interface returns a "Server error 50x" when just trying to connect to it. Unplug my pfsense (2100) firewall, wait a minute, plug it back in, finall…

• Mention Netgate Releases Netgate Nexus Version 26.07_1 · Reddit · 2026-09-11

  Netgate ® Nexus enables Multi-Instance Management for pfSense ® Plus, and is the future of the pfSense GUI. Designed to address the growing complexity of managing multiple pfSense Plus instances across distributed environments, Netgate Nexus empowers network operators to securel…

• Mention 26.07 CoreDNS Threatgate - Anyone running it now? · Reddit · 2026-08-28

  I have not seen any posts in here on the subject I plan to start learning it soon, on a Proxmox vm for testing. Anyone in here have it running? I ask because a lab will give me practice in setting it up, but not real world usage as it will be internal only. Not willing to go liv…

• Mention I built an open-source MCP server for pfSense — and tried very hard not to give the AI unrestricted firewall write access · Reddit · 2026-08-16

  UPDATE — v1.0.0 is now released pfsense-mcp-server has reached its first stable release. A lot has changed since the v0.5.0 update, but the main goal for v1.0 wasn't to keep adding tools. It was to harden what was already there, simplify the setup, and verify that the security m…

• Mention Will The Official pfSense API Be Updated To Support 26.07? · Reddit · 2026-08-15

  First, let me start by thanking the pfSense team. I have completed my installation of the latest pfSense+ version. And it is working well - thus far. But as anyone who has done this before knows, new versions often lose installed packages. This is the case for the "official" pfS…

Reports are found automatically and labelled by an AI model plus keyword rules — they can be wrong. Open the post to judge for yourself.

← pfSense Plus 26.03.1

Other pfSense versions

• CE 2.9.0 2026-08-20
• Plus 26.07 2026-08-13
• Plus 26.03.1 2026-05-27
• Plus 26.03 2026-04-01
• Plus 25.11.1 2026-01-26
• Plus 25.11 2025-12-11
• CE 2.8.1 2025-09-04
• Plus 25.07.1 2025-08-18