CVE-2026-56128: Netgate Pfsense CE

Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days.

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.

Affected products

• Netgate Pfsense CE: before 2.9.0 (fixed in 2.9.0)
• Netgate Pfsense Plus: before 26.07 (fixed in 26.07)

Published 2026-09-03. Last modified 2026-09-09.