pfSense Remote Code Execution Vulnerabilities

CERT-Bund published a security advisory identifying multiple vulnerabilities in Netgate pfSense Plus and CE firewall software with CVSS Base Score 8.8 (high severity). Affected products include pfSense Plus versions prior to 26.03 and 26.07, and CE versions prior to 2.8.1. The vulnerabilities enable remote attackers to execute arbitrary code and perform cross-site scripting attacks. No specific CVE identifiers or patch versions were detailed in this advisory.

Organizations running affected pfSense versions should immediately identify exposed installations and apply available mitigations. Prioritize patching pfSense instances accessible from the internet given the remote attack vector. Conduct security assessments to detect potential exploitation attempts. Monitor CERT-Bund for updated information including CVE references and fixed version numbers.