pfSense

A medium-severity vulnerability, tracked as EUVD-2026-70495 with a CVSS score of 5.1, affects Netgate's pfSense Plus before version 26.07 and pfSense CE before 2.9.0. The flaw lets authenticated users holding the Status: Monitoring privilege inject arbitrary content, potentially leading to further abuse. Netgate published the advisory on 3 September 2026 and updated it on 1 October; administrators are advised to upgrade.

A medium-severity vulnerability, EUVD-2026-70496, has been published for Netgate's pfSense firewall software. Versions of pfSense Plus before 26.07 and pfSense CE before 2.9.0 allow authenticated users holding the Firewall: Rules: Edit privilege to inject data, according to the advisory rated 5.1 out of 10 under CVSS v3.1. The issue was published on 3 September 2026 and updated on 1 October. Administrators running affected versions are advised to update.

A vulnerability tracked as EUVD-2026-70498 affects Netgate's pfSense Plus before 26.07 and pfSense CE before 2.9.0, carrying a CVSS v3.1 score of 5.1 out of 10. It allows authenticated users holding the Firewall: Schedules: Edit privilege to inject malicious content. Netgate published the advisory on 3 September 2026 and updated it on 1 October, and administrators of pfSense firewalls are being urged to update their installations.