Advisories
Netgate pfSense Remote Code Execution Vulnerability (Sept 16 2026)
A critical flaw in Netgate’s pfSense firewall software allows attackers to run arbitrary code remotely. The issue affects all pfSense CE releases older than 2.9.0 and all pfSense Plus builds before 26.07. The vulnerability was disclosed by the French CERT (CERT‑FR) and a patch is available in the Netgate Security Advisory SA‑26_22. Administrators should update immediately to mitigate the risk of compromise.
What’s at stake?
A newly uncovered flaw in Netgate pfSense can be exploited from outside the network, giving an attacker full control over the affected device. The weakness lies in the way pfSense handles certain configuration requests, allowing arbitrary code execution without authentication.
Systems impacted
- pfSense CE – any version prior to 2.9.0
- pfSense Plus – any build before 26.07
How to protect yourself
Download the latest patch from Netgate’s official advisory (SA‑26_22, released 15 September 2026) and apply it to all vulnerable installations. Verify that the firmware version is at least 2.9.0 for CE or 26.07 for Plus before proceeding.
"The vulnerability is exploitable by unauthenticated remote actors. Prompt remediation is essential to prevent potential takeover of your network perimeter."
Next steps for administrators
- Check current pfSense version via the webGUI or CLI.
- Download the patch from the Netgate website (no need for additional credentials).
- Apply the update in a maintenance window and reboot the device.
- Validate the new version and monitor logs for any suspicious activity.
Related vulnerabilities
Critical RCE in Cisco Nexus 9000 Silicon One – Unauthenticated Remote Code Execution via Open Ports 43210/43211
Cisco has disclosed a critical remote code execution flaw in the Silicon One integration on its Nexus 9000 Series switches. The vulnerability, CVE‑2026‑20212, exposes TCP ports 43210 and 43211 in the default L3 VRF, allowing any unauthenticated attacker to send crafted packets that execute as root and can even crash the S1HAL process, forcing a device reload. Cisco has issued patches and workarounds; administrators should update immediately to mitigate the risk.
Read briefing
Fortinet Issues Mass Security Fixes for RCE and Privilege Escalation Vulnerabilities
Fortinet has released updates resolving multiple security vulnerabilities across its product portfolio, including FortiOS, FortiManager, and FortiAnalyzer. Successful exploitation could allow remote code execution, privilege escalation, and denial-of-service attacks. Network administrators should patch affected installations promptly.
Read briefing
Oracle Database Server Hit by Multi‑Vulnerability Storm: Remote Code Execution & DoS
A wave of critical flaws in Oracle Database Server—spanning 19.3 through 23.26.3—enables attackers to launch remote code execution and denial‑of‑service attacks. The vulnerabilities, catalogued under CVE‑2026‑83088 to CVE‑2026‑83351, affect all major releases from 19.3 to 23.26.3. Oracle has released patches in the 15 September 2026 security bulletin. Immediate patching is mandatory for any exposed database instances. CERT‑FR has issued an alert urging rapid remediation.
Read briefing
HPE Aruba SD‑WAN Products Hit by Multiple Remote Code Execution and Privilege‑Escalation Flaws
HPE Aruba Networking has disclosed a set of critical flaws in its EdgeConnect SD‑WAN Gateways and Orchestrator that can be exploited for remote code execution, privilege escalation, and denial‑of‑service. Affected releases include Gateway 9.4.x‑9.7.x (pre‑9.4.9.0, 9.5.9.0, 9.6.4.0, 9.7.1.0) and Orchestrator 9.4.x‑9.7.x (pre‑9.4.11, 9.5.9, 9.6.4, 9.7.1.0). The CVE list ranges from CVE‑2024‑32664 to CVE‑2026‑76696. Patch the firmware immediately and follow HPE’s advisory for configuration hardening.
Read briefing