Netgate Releases pfSense Community Edition Version 2.9.0

pfSense^® software, the world’s leading firewall, router, and VPN solution, provides secure network edge and cloud networking solutions for millions of deployments worldwide.

Netgate^® is excited to announce the release of pfSense Community Edition (CE) software version 2.9.0. This new version includes over 150 new features, enhancements, and fixes. All pfSense CE users are encouraged to upgrade to this new version.

Feature Highlights

This release software includes a large number of security and feature enhancements. Some highlights include:

SSH Algorithms

This release includes several changes to algorithms for the SSH daemon for key exchange, encryption, and message authentication. These changes increase security by including post-quantum key exchange algorithms and by removing older and weaker algorithms.

TLS Certificate Strength

The version of OpenSSL in this release further tightens certificate requirements and removes support for certain weak properties. For example, if a TLS server certificate for a service such as the GUI has a weak key (<2048 bits), the service may fail with an error such as “key too small”. This version of pfSense software checks the GUI certificate during the upgrade process and will re-generate a new GUI certificate if the current certificate is invalid, expired, or weak.

TLS Certificate Auto-Renew

This version of pfSense software can automatically renew TLS server certificates which are self-signed or signed by an internal CA stored in the pfSense software configuration. Automatic renewal is a per-certificate option, and pfSense software automatically enables this option for the GUI certificate when possible. When automatically renewing a certificate, pfSense software uses the latest strict security options to ensure the certificate meets current standards.

Endpoint-independent Port Restricted Cone Outbound NAT

This version includes partial experimental support for “Port Restricted Cone” endpoint-independent outbound NAT. “Port Restricted Cone” NAT mappings attempt to preserve port and external address mappings for clients when speaking to multiple remote hosts, but in a dynamic way that does not rely on static port NAT. This helps avoid issues with multiple local clients using the same source port to the same remote host.

Security Updates

This Release software includes critical security updates for WireGuard (CVE-2026-58085), as well as fixes for the following security fixes:

• pfSense-SA-25_09.sshguard: Anti-brute force protection bypass and potential denial of service
• pfSense-SA-26_01.webgui: The isvalidpid() function does not properly check or escape PID file parameter
• pfSense-SA-26_02.webgui: Potential XSS in Delegated Length value for Prefix Delegation on services_dhcpv6.php when using Kea
• pfSense-SA-26_03.webgui: Potential Stored XSS in diag_arp.php when using ISC DHCP
• pfSense-SA-26_04.webgui: Potential XSS in RSS Widget feed content post titles
• pfSense-SA-26_05.webgui: Potential XSS in Captive Portal widget

Security and errata fixes were merged from FreeBSD, including fixes for vulnerabilities discovered in OpenSSL and the DHCP client, and base system packages were updated to address various upstream security issues.

Operating System and Base Component Updates

Numerous systems were updated, including:

• Base OS updated to FreeBSD 16-CURRENT
• OpenSSL upgraded to 3.5.7
• OpenSSH upgraded to 10.3p1
• PHP updated to 8.5.7

Hardware Errata

Certain hardware with a specific firmware problem, including some Celeron J devices, may encounter a kernel panic when attempting to boot pfSense CE software version 2.9.0. To avoid this panic on that hardware, set a loader tunable for hint.acpi_spmc.0.disabled=1 in /boot/loader.conf.local before upgrading to disable the driver that has an issue on that hardware. See Managing Loader Tunables for information on how to edit or create that file.

Release Notes

Release Notes for pfSense CE 2.9.0-RELEASE are available for a more comprehensive list of new features, bug fixes, and other changes in this release.

Installing the Upgrade

Netgate has a detailed Upgrade Guide available in the pfSense documentation to help explain the process. Below are the high-level steps to perform the upgrade.

Users currently running pfSense Community Edition (CE) software

Upgrades from an earlier version of pfSense CE software are usually made through the web-based user interface. Before any major change, such as an upgrade, the best practice is always to create and securely store a backup of the pfSense configuration. The pfSense documentation contains detailed Backup and Recovery instructions.

To perform the update:

• Navigate to System > Update in the pfSense software GUI
• Set Branch to “Current Stable Version (2.9.0)”
• Click Confirm to start the upgrade process

We encourage users to migrate from pfSense CE software to pfSense Plus software. Doing so will ensure you have access to all of the benefits of pfSense Plus software. You can find details on how to get pfSense Plus software in the Netgate store.

Troubleshooting the Upgrade

Please review the documentation on Troubleshooting Upgrades for the most up-to-date information on working around upgrade issues.

This pfSense CE software release is ready for use in production environments. Should any issues arise, please post to our forum or contact Netgate Technical Assistance Center (TAC) for paid assistance.

Supporting the Project

When you purchase Netgate hardware, TAC, or AWS/Azure cloud instances, you directly sustain the engineering teams responsible for maintaining high quality pfSense software.

You may support this work through one or more of the following:

• Purchase an official appliance directly from Netgate or from our worldwide reseller partner network. Our appliances are the fast, easy way to get up and running with a fully-optimized firewall.
• Purchase a TAC subscription, which provides you with direct access to Netgate Global Support
• Purchase Professional Services, which provides access to our most senior engineers for more complex projects outside the scope of TAC requests.
• Use a genuine pfSense Plus instance from Netgate to connect and protect your cloud workloads on AWS and Azure.

Our efforts are made possible by the support of our customers and the community, and for that we express our sincere thanks. This involvement makes the pfSense project a stronger solution for everyone.