Authenticated XSS via schedule descr param in pfSense <26.07/CE <2.9
CVE-2026-56128 Published on September 3, 2026
pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.
Vulnerability Analysis
CVE-2026-56128 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-56128 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-56128
stack.watch emails you whenever new vulnerabilities are published in Netgate Pfsense Plus or Netgate Pfsense Ce. Just hit a watch button to start following.
Affected Versions
Netgate pfSense Plus:- Before 26.07 is affected.
- Before 2.9.0 is affected.