Netgate pfSense patches multiple RCE flaws
ANSSI/CERT-FR flags multiple pfSense CE and Plus vulnerabilities allowing remote code execution, data compromise, and XSS.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR issued an advisory covering several vulnerabilities in Netgate's pfSense CE (prior to 2.9.0) and pfSense Plus (prior to 26.07) firewall products. The flaws collectively enable remote attackers to execute arbitrary code, compromise data confidentiality and integrity, and perform indirect remote code injection via cross-site scripting (XSS). Netgate published a series of security bulletins (pfSense-SA-26_06 through SA-26_21) on 13 August 2026 detailing the individual issues, with four CVEs assigned: CVE-2026-56126, CVE-2026-56127, CVE-2026-56128, and CVE-2026-67189.
No exploitation in the wild is reported; this is a vendor-driven patch disclosure. Given pfSense's widespread use as a perimeter firewall/router in SMB, enterprise, and home-lab environments, unpatched instances present a notable attack surface, particularly given the RCE potential. Administrators should apply the referenced patches per Netgate's bulletins promptly, as no workaround details are provided in the advisory.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1022
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs