Auth JS Injection in pfSense <=26.07 / CE 2.9.0 via /status_monitoring.php
CVE-2026-56126 Published on September 3, 2026
pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.
Vulnerability Analysis
CVE-2026-56126 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-56126 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-56126
stack.watch emails you whenever new vulnerabilities are published in Netgate Pfsense Plus or Netgate Pfsense Ce. Just hit a watch button to start following.
Affected Versions
Netgate pfSense Plus:- Before 26.07 is affected.
- Before 2.9.0 is affected.