CVE-2026-56127: Netgate Pfsense CE

Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days.

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status_logs_filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.

Affected products

• Netgate Pfsense CE: before 2.9.0 (fixed in 2.9.0)
• Netgate Pfsense Plus: before 26.07 (fixed in 26.07)

Published 2026-09-03. Last modified 2026-09-09.