pfSense Plus <=26.07 & CE <=2.9.0 Auth XSS via firewall descr
CVE-2026-56127 Published on September 3, 2026
pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status_logs_filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.
Vulnerability Analysis
CVE-2026-56127 can be exploited with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-56127 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-56127
Want to know whenever a new CVE is published for Netgate products? stack.watch will email you.
Affected Versions
Netgate pfSense Plus:- Before 26.07 is affected.
- Before 2.9.0 is affected.