CVE-2026-56126
Received Received - Intake

Stored XSS in pfSense Plus and pfSense CE Monitoring Page

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-56126
EUVD
EUVD-2026-70495

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
netgate pfsense_plus to 26.07 (exc)
netgate pfsense_ce to 2.9.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in pfSense. Authenticated users with 'Status: Monitoring' privileges can inject arbitrary JavaScript via POST parameters like graph-left, graph-right, and time-period in /status_monitoring.php. The unsanitized input is stored in the pfSense XML configuration and executed when the page is viewed by other users.

Detection Guidance

Check if your pfSense Plus version is before 26.07 or CE version is before 2.9.0. Inspect the Status Monitoring page for unusual JavaScript in saved configurations. Look for POST parameters like graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval being stored unsanitized.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or access sensitive information displayed on the Status Monitoring page. The impact is limited to users with access to the Status Monitoring page, but the stored payload affects all visitors to that page.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's security rules. Organizations must address it to maintain compliance with data protection regulations.

Mitigation Strategies

Upgrade pfSense Plus to 26.07 or later and pfSense CE to 2.9.0 or later. Manually update the Status Monitoring package to version 1.9 (Plus) or 1.8_10 (CE). Remove or sanitize any suspicious JavaScript payloads from saved configurations in status_monitoring.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart