Multiple vulnerabilities affecting pfSense

pfSense is a FreeBSD-based firewall and router software distribution deployed in enterprise environments for network traffic management, VPN tunnel termination, and network segmentation. The vulnerabilities were discovered and made public on October 13, 2026 by security researcher abraxas (formerly Mandiant/Trellix ARC). Five command injection vulnerabilities affecting the pfSense web administration interface have been disclosed. They result from insufficient validation and escaping of user input before passing it to system commands (ifconfig, dnctl, strongSwan scripts). These vulnerabilities would allow an authenticated malicious actor to execute arbitrary code remotely with root privileges and take complete control of the firewall, thereby compromising the entire network protected by affected pfSense instances.

• pfSense version 2.9.0-DEVELOPMENT;

RECOMMENDED ACTIONS:

• Apply security patches as soon as they are released;
• Audit outgoing network logs for suspicious connections;
• Restrict access to the pfSense web administration interface to only trusted IP addresses;
• Review all accounts with administrative privileges;