Skip to content
OpenAdvisories

Vendor

Netgate

39 known vulnerabilities.

Netgate at a glance

Last 12 months
27
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 10 20 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 2 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 2 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 4 vulnerabilities Sep October 2026: 18 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 2026180
Sep 202640
Aug 202610
Jul 202600
Jun 202600
May 202600
Apr 202620
Mar 202600
Feb 202620
Jan 202600
Dec 202500
Nov 202510
Oct 202500
Sep 202570
Aug 202500
Jul 202500
Jun 202510
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

pfSense CE 29 pfSense Plus 5 Netgate pfSense 3 pfSense 2 NETGATE Registry Cleaner 1 Data Backup 1 NETGATE AMITI Antivirus 1 Amiti Antivirus 1 pfSense-pkg-frr 1 pfSense < 2.7.0 0 pfSense pfBlockerNg <= 2.1.4_27 0 pfSense Plus < 22.05 0 pfSense 2.4.4 0 pfSense v.2.1.3 0 pfSense Suricata v.1.4.6 pkg v.1.0.1 0 pfSense 2.6.0 0 pfSense Plus master < 23.09 0 pfSense CE master < 2.8.0 0 pfSense Plus master < 23.05 0 pfSense CE master < 2.7.0 0 pfSense Plus <= 22.05.1 0 pfSense CE <= 2.6.0 0

Latest advisories

  • Medium max 8.6
    WID-SEC-2026-3983 20 CVEs

    Netgate pfSense: Mehrere Schwachstellen

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen und um auf Dateien zuzugreifen.

    Netgate
  • High max 8.5
    WID-SEC-2026-2836 5 CVEs rev. 5

    Netgate pfSense: Mehrere Schwachstellen

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um beliebigen Programmcode auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

    Netgate
    first Aug 13, 2026
  • High max 8.8
    WID-SEC-2026-3974 1 CVE

    Netgate pfSense: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Netgate pfSense ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

    Netgate
  • High
    WID-SEC-2026-3386 0 CVEs rev. 2

    Netgate pfSense: Schwachstelle ermöglicht Codeausführung

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Netgate pfSense ausnutzen, um Sicherheitsmaßnahmen zu umgehen und beliebigen PHP-Code und Shell-Befehle auszuführen.

    Netgate
    first Sep 15, 2026
  • High max 5.4
    WID-SEC-2026-0961 1 CVE rev. 2

    Netgate pfSense Plus und CE: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Netgate pfSense Plus und CE ausnutzen, um beliebigen Programmcode auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen.

    Netgate
    first Apr 1, 2026
All Critical High Medium Low Exploited only Public exploit

39 results · Feed

  • Medium 4.7
    CVE-2026-111233

    Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php

    Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enable…

    Netgate pfSense CE
  • Medium 4.8
    CVE-2026-111232

    Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color

    Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted se…

    Netgate pfSense CE
  • Medium 4.9
    CVE-2026-111230

    Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL

    Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result…

    Netgate pfSense CE
  • Medium 5.5
    CVE-2026-111228

    Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php

    Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in th…

    Netgate pfSense CE
  • Medium 5.5
    CVE-2026-111227

    Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php

    Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF character…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111226

    Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php

    pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block…

    Netgate pfSense CE
  • Medium 5.0
    CVE-2026-111225

    Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh

    Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common…

    Netgate pfSense CE
  • High 7.5
    CVE-2026-111224

    Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh

    pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can us…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111223

    Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner

    Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '…

    Netgate pfSense CE
  • Medium 6.6
    CVE-2026-111222

    Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting

    Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_pre…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111220

    Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid

    pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Inter…

    Netgate pfSense CE
  • Medium 6.6
    CVE-2026-111219

    Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username

    Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a lin…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111218

    Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters

    Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111217

    Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metac…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111216

    Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a …

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111215

    Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface

    Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments pr…

    Netgate pfSense CE
  • High 7.2
    CVE-2026-111214 EPSS 11%

    Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php

    Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit …

    Netgate pfSense CE
  • High 8.8
    CVE-2026-110908

    Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulne…

    Netgate pfSense-pkg-frr
  • High 8.5
    CVE-2026-97730

    In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Das…

    Netgate pfSense CE pfSense Plus
  • Medium 5.4
    CVE-2026-56128

    pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitiz…

    Netgate pfSense CE pfSense Plus
  • Medium 5.4
    CVE-2026-56127

    pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML con…

    Netgate pfSense CE pfSense Plus
  • Medium 5.4
    CVE-2026-56126

    pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-rig…

    Netgate pfSense CE pfSense Plus
  • Medium 6.1
    CVE-2026-67189

    pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record

    pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses a…

    Netgate pfSense CE pfSense Plus
  • High 7.8
    CVE-2016-20058

    Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation

    Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivirusHealth services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted service p…

    Netgate NETGATE AMITI Antivirus
  • High 7.8
    CVE-2016-20057

    NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation

    NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the unqu…

    Netgate NETGATE Registry Cleaner
  • High 7.8
    CVE-2019-25271

    NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path

    NETGATE Data Backup 3.0.620 contains an unquoted service path vulnerability in its NGDatBckpSrv Windows service configuration. Attackers can exploit the unquoted path to inject and execute malicious code with LocalSystem privileges by placing executable files…

    Netgate Data Backup
  • High 7.8
    CVE-2019-25269

    Amiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability

    Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges by placing executable files in sp…

    Netgate Amiti Antivirus
  • High 8.8
    CVE-2025-12490 EPSS 17%

    Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability

    Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Netgate pfSense. Authentication is required to exploit this vulnerability. The sp…

    Netgate pfSense
  • Medium 5.1
    CVE-2025-34178

    Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting

    In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated wi…

    Netgate pfSense CE
  • Medium 5.1
    CVE-2025-34177

    Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting

    In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated wi…

    Netgate pfSense CE
  • Medium 5.3
    CVE-2025-34176 EPSS 20%

    Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure

    In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be…

    Netgate pfSense CE
  • Medium 5.1
    CVE-2025-34175 EPSS 24%

    Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting

    In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated.

    Netgate pfSense CE
  • Medium 5.1
    CVE-2025-34174 EPSS 17%

    Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting

    In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the …

    Netgate pfSense CE
  • Medium 5.3
    CVE-2025-34173

    Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure

    In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used to check if a file exists. While the contents of the file cannot be read, the se…

    Netgate pfSense CE
  • Medium 4.8
    CVE-2025-34172

    Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting

    In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated.

    Netgate pfSense CE
  • Medium 5.0
    CVE-2025-53392 Public exploit

    In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_comm…

    Netgate pfSense
  • High 7.2
    CVE-2018-4019 EPSS 49%

    An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the paramet…

    Netgate Netgate pfSense
  • High 7.2
    CVE-2018-4020 EPSS 49%

    An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the paramet…

    Netgate Netgate pfSense
  • High 7.2
    CVE-2018-4021 EPSS 70%

    An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the paramet…

    Netgate Netgate pfSense